SB2026083135 - Multiple vulnerabilities in Open WebUI

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026083135

SB2026083135 - Multiple vulnerabilities in Open WebUI

Published: August 31, 2026

Security Bulletin ID SB2026083135
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 14% Low 86%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the message-chain reconstruction helper in backend/open_webui/utils/misc.py when processing a crafted cyclic chat message history. A remote user can store a specially crafted chat history and trigger chat history reconstruction to cause a denial of service.

The issue is triggered by messages that reference each other through parent links while omitting the id field, and the blocking work continues even if the client disconnects.


2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to retain unauthorized access to the application.

The vulnerability exists due to improper access control in the OAuth token exchange endpoint in backend/open_webui/routers/auths.py when exchanging a provider access token for a session. A remote attacker can present a valid provider access token for an existing linked account to obtain a working session and retain unauthorized access to the application.

The issue affects deployments only when ENABLE_OAUTH_TOKEN_EXCHANGE is enabled and the skipped domain or role controls are in use. The endpoint does not create new accounts, and exploitation requires a valid unexpired provider access token for an existing account or a matching email when account merging by email is enabled.


3) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an infinite loop in the chat-history message deletion helper in backend/open_webui/models/chats.py when deleting a message from a chat history whose childrenIds links form a cycle. A remote user can store a crafted cyclic chat tree and delete a message to cause a denial of service.

The issue is triggered through DELETE /api/v1/chats/{id}/messages/{message_id}, and the blocking work continues even if the client disconnects.


4) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from blocked or internal hosts via server-side requests.

The vulnerability exists due to server-side request forgery in the web retrieval fetch paths, built-in page fetch tool, and URL ingestion endpoint when following HTTP redirects during server-side URL fetching. A remote user can submit a URL that redirects to an excluded or internal destination to disclose sensitive information from blocked or internal hosts via server-side requests.

The issue is exposed only when redirect following is enabled through AIOHTTP_CLIENT_ALLOW_REDIRECTS, and it affects features that cause the server to fetch user-supplied URLs.


5) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from internal services.

The vulnerability exists due to server-side request forgery (SSRF) in the server-side URL fetch functionality when processing user-supplied URLs for RAG URL ingestion and web search. A remote user can submit a crafted URL to make the server fetch internal addresses and disclose sensitive information from internal services.

Only the server-side fetch paths are affected, and user interaction is not required. On Azure-hosted deployments, the reachable internal destination includes the Azure platform channel; deployments not hosted on Azure are unaffected for that specific address.


6) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject chats into another user\'s folder.

The vulnerability exists due to missing authorization in the chat-completions handler in backend/open_webui/main.py when handling POST requests to /api/chat/completions and /api/v1/chat/completions with a user-supplied folder id. A remote user can send a crafted request with a target folder id to inject chats into another user\'s folder.

Folders must be enabled, and exploitation requires knowledge of the target folder id. Shared folders with read-only access are reachable, while unshared folders are not practically reachable through available endpoints.


7) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete administrator-owned external knowledge connections and cause a denial of service.

The vulnerability exists due to incorrect authorization in the knowledge base delete handler in backend/open_webui/routers/knowledge.py when handling DELETE /api/v1/knowledge/{id}/delete requests for external knowledge bases. A remote user can delete a knowledge base with write access to remove a shared external connection from instance configuration and cause a denial of service.

Only deployments using external knowledge bases backed by qdrant, milvus, or pgvector are affected. Read access alone is insufficient, and the issue is more severe when multiple knowledge bases share the same connection.


Remediation

Install update from vendor's website.

References