Known vulnerabilities in Open WebUI

Vendor: Open WebUI
Software: Open WebUI
Software CPE: cpe:2.3:a:open_webui:ollama_webui:*:*:*:*:*:*:*:*
Total vulnerabilities: 134
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Open WebUI Open WebUI is affected by 134 known vulnerabilities: 4 high, 24 medium, 106 low Critical High Medium Low

Vulnerabilities (134)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140763 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-54020
CWE-367 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140762 - Missing Authorization
CWE-862 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140761 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140760 - Incorrect Authorization
CWE-863 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140759 - Missing Authorization
CWE-862 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140758 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140757 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140756 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140755 - Exposure of sensitive information to an unauthorized actor
CWE-200 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140754 - Missing Authorization
CWE-862 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140753 - Incorrect Authorization
CWE-863 Medium
No
No
0.11.0 03.08.2026 SB2026080325
#VU140752 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140751 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140750 - Missing Authorization
CWE-862 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140749 - Resource exhaustion
CWE-400 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140748 - Inefficient Regular Expression Complexity
CWE-1333 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140747 - Improper Authentication
CWE-287 High
No
No
0.11.0 03.08.2026 SB2026080325
#VU135954 - Improper Authorization
CVE-2026-59226
CWE-285 Low
No
No
0.10.0 30.06.2026 SB2026063040
#VU135955 - Incorrect Authorization
CWE-863 Low
No
No
0.10.0 30.06.2026 SB2026063040
#VU135953 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-59214
CWE-79 Low
No
No
0.10.0 30.06.2026 SB2026063040


Showing elements 1 - 20 out of 134