SB2026080325 - Multiple vulnerabilities in Open WebUI

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080325

SB2026080325 - Multiple vulnerabilities in Open WebUI

Published: August 3, 2026

Security Bulletin ID SB2026080325
CSH Severity
High
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 6% Medium 6% Low 88%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the tool read endpoints when handling requests for shared tools. A remote user can call the affected endpoints to disclose sensitive information.

Authentication and enabled plugins are required, and the issue affects tools shared with read access where the caller does not have write access.


2) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-54020)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from internal services.

The vulnerability exists due to a time-of-check time-of-use race condition in server-side URL fetch handlers when processing user-supplied URLs. A remote user can control authoritative DNS responses for a submitted hostname to make the server connect to an internal address and disclose sensitive information from internal services.

Most affected fetch paths return the internal response to the user, while the image-edit path is blind. On the OAuth profile-picture fetch path, the server also forwards the OAuth access token as a Bearer header to the fetched URL.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in the chat completion, chat completed, and chat action endpoints and builtin knowledge tools when processing an inline model definition with attached knowledge metadata. A remote user can send a specially crafted chat request referencing another user's file id to disclose sensitive information.

Exploitation requires a valid session id, native function calling, and knowledge tools with the model's builtin_tools capability enabled. The attacker must already know the target file id.


4) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete directories and remove file embeddings in other knowledge bases.

The vulnerability exists due to authorization bypass through user-controlled key in the sync_knowledge_cleanup handler when processing directory and file identifiers supplied in the request body. A remote user can send a specially crafted cleanup request to delete directories and remove file embeddings in other knowledge bases.

The issue affects the POST /api/v1/knowledge/{id}/sync/cleanup endpoint and requires write access to one knowledge base and knowledge of the target directory or file identifier; in practice this is typically reachable by a read-only collaborator on a shared knowledge base.


5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain unauthorized terminal access.

The vulnerability exists due to incorrect authorization in the _resolve_authenticated_connection helper backing the /{server_id}/api/terminals/{session_id} WebSocket route when authenticating terminal WebSocket connections. A remote user can open a terminal WebSocket session with a valid JWT for a pending account to gain unauthorized terminal access.

At least one terminal server must be configured, and the applicable terminal access grants must already allow the account through public access or group membership. Deployments with no terminal server configured or with admin-only terminal grants are not affected.


6) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the chat-completions endpoint when handling chat-completion requests with a client-supplied image-generation feature flag. A remote user can send a specially crafted chat-completion request to cause a denial of service.

Image generation must be enabled and a provider must be configured. On 0.10.0 and later, exploitation requires setting params.function_calling to legacy; deployments using native function calling are unaffected.


7) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in the victim's browser and take over the viewing account.

The vulnerability exists due to cross-site scripting in the KaTeX render-error fallback in rendered messages when rendering a stored message containing crafted math input that causes KaTeX rendering to fail. A remote user can store a specially crafted message and get a victim to open it to execute arbitrary script in the victim's browser and take over the viewing account.

User interaction is required for the target to view the crafted content, such as through a shared chat, a channel, or another message surface.


8) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to cause the victim's browser to send attacker-chosen outbound requests and disclose response data from same-origin or CORS-permissive targets.

The vulnerability exists due to server-side request forgery in Vega/Vega-Lite chart rendering when rendering untrusted vega or vega-lite chat content in the viewer's browser. A remote user can place a specially crafted chart specification where the victim will view it to cause the victim's browser to send attacker-chosen outbound requests and disclose response data from same-origin or CORS-permissive targets.

User interaction is required because the victim must open the message containing the crafted chart.


9) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute script in the application origin and take over a victim account.

The vulnerability exists due to cross-site scripting in the terminal file preview iframe in FilePreview.svelte when rendering HTML files served through the terminal file preview path. A remote user can cause a crafted HTML file to be previewed to execute script in the application origin and take over a victim account.

Exploitation requires a configured and reachable terminal server, and no victim interaction beyond having the chat open because the preview opens automatically. Instances without a terminal server configured are not affected.


10) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to take over another user's account.

The vulnerability exists due to improper authentication in the OAuth token exchange endpoint when validating provider access tokens through the userinfo endpoint without verifying the issuing client. A remote attacker can obtain a provider access token issued to another OAuth client and exchange it for an Open WebUI session to take over another user's account.

The issue affects deployments only when ENABLE_OAUTH_TOKEN_EXCHANGE=True. User interaction is required for the victim to sign in to an unrelated OAuth application so the attacker can obtain the victim's provider access token. The endpoint does not create users, so the target must already have an account.


11) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to missing authorization in delete_chat_by_id when handling DELETE /api/v1/chats/{id} requests. A remote user can send a delete request for another user's chat to cause a denial of service.

The issue affects cancellation of in-flight chat tasks before authorization is checked, and exploitation requires knowledge of the target chat id while a generation is running.


12) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to permanently delete another user's chats and messages within a shared folder subtree.

The vulnerability exists due to incorrect authorization in the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py when handling deletion requests for shared subfolders. A remote user can send a crafted folder deletion request to permanently delete another user's chats and messages within a shared folder subtree.

The issue is exposed only when folder sharing is enabled, and the victim has granted write access to a shared folder. The inherited write grant applies to descendant subfolders, including ones not explicitly shared with the caller.


13) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from internal services reachable by the browser process.

The vulnerability exists due to server-side request forgery (SSRF) in SafePlaywrightURLLoader when processing user-submitted URLs that cause unvalidated sub-resource requests. A remote user can submit a crafted URL for ingestion or trigger a web search to disclose sensitive information from internal services reachable by the browser process.

Only instances using the Playwright web loader are vulnerable, and the returned page DOM can expose data read from reachable internal services through normal web-search or document-ingestion results.


14) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from internal services and cloud metadata endpoints.

The vulnerability exists due to server-side request forgery in URL fetching and address validation logic in backend/open_webui/retrieval/web/utils.py when processing user-supplied URLs containing NAT64-encoded IPv6 literals. A remote user can submit a specially crafted URL to disclose sensitive information from internal services and cloud metadata endpoints.

Exploitation requires an authenticated account and a deployment network that provides NAT64 translation for the 64:ff9b::/96 prefix.


15) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify or delete other users' messages in a standard channel.

The vulnerability exists due to missing authorization in update_message_by_id and delete_message_by_id in backend/open_webui/routers/channels.py when handling update and delete requests for standard-channel messages. A remote user can send crafted requests referencing another member's message ID to modify or delete other users' messages in a standard channel.

Only standard channels are affected, and channels must be enabled. Group and direct message channels are not affected.


16) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in _parse_rule in backend/open_webui/utils/automations.py when parsing automation recurrence rules. A remote user can create or store a specially crafted automation rule to cause a denial of service.

The issue affects instance availability because the next-run computation is performed synchronously on the event loop and is repeatedly recomputed by the scheduler after the automation is stored. On default deployments, only an admin can reach the vulnerable create path unless the automations feature has been granted to ordinary users.


17) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in grep_knowledge_files when processing a user-supplied knowledge-search pattern. A remote user can supply a crafted pattern that triggers catastrophic backtracking to cause a denial of service.

User interaction by the model is required to invoke the affected tool with the supplied literal pattern, and single-worker deployments can lose the whole instance while multi-worker deployments lose one worker per request.


Remediation

Install update from vendor's website.

References