Iniciar sesión
Deutsch English Español Polski
Media

Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read

  • Publicada: 20.03.2025
  • Actualizado: 11.10.2026 13:19

In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt information created by the admin, which includes the ID values. Subsequently, the attacker can exploit the /api/v1/prompts/command/{command_id} interface to obtain arbitrary prompt information.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) open-webui <= 0.3.8 sin corrección

Referencias

Puntuación CVSS 4.3/10
Vector CVSS
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Debilidad (CWE)
CWE-1100, CWE-862
Plataforma
Python (PyPI)
Paquete
open-webui
Publicada
20.03.2025
Actualizado
11.10.2026 13:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-1727 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-c7fq-p62p-wvpc - CC BY 4.0

Historial de vulnerabilidades: open-webui

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (161) en el archivo
Entradas en total
161
Primera → última
08.2024 09.2026
Sin corrección
11
Explotada en ataques
0

Distribución por gravedad

  • Crítica 1
  • Alta 77
  • Media 75
  • Baja 8

Divulgaciones por año

Gravedad:
  1. Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read esta entrada
    Media · 4.3 CVE-2024-7045 <= 0.3.8 sin corrección
  2. Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
    Alta · 7.5 CVE-2026-87011 >= 0.9.0, < 0.11.1 0.11.1
  3. Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
    Alta · 8.1 CVE-2026-87016 >= 0.6.41, < 0.11.1 0.11.1
  4. Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
    Alta · 8.7 CVE-2026-87995 >= 0.8.11, < 0.11.1 0.11.1
  5. Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
    Alta · 7.7 CVE-2026-87996 >= 0.9.6, < 0.11.1 0.11.1
  6. Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
    Alta · 7.1 CVE-2026-87998 >= 0.10.0, < 0.11.1 0.11.1
  7. Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
    Alta · 7.1 CVE-2026-87999 < 0.11.1 0.11.1
  8. Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
    Alta · 8.1 CVE-2026-70494 >= 0.10.0, < 0.11.0 0.11.0
  9. Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
    Alta · 8.7 CVE-2026-70492 >= 0.10.0, < 0.11.0 0.11.0
  10. Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
    Alta · 8.2 CVE-2026-70486 >= 0.9.0, < 0.11.0 0.11.0
  11. Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
    Alta · 7.1 CVE-2026-70485 >= 0.9.0, < 0.11.0 0.11.0
  12. Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
    Alta · 8.1 CVE-2026-70482 >= 0.8.0, < 0.11.0 0.11.0
  13. Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
    Alta · 7.7 CVE-2026-70479 >= 0.9.6, < 0.11.0 0.11.0
  14. open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
    Alta · 7.7 CVE-2026-59221 >= 0.9.6, < 0.10.0 0.10.0
  15. Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
    Alta · 8.0 CVE-2026-59224 < 0.10.0 0.10.0
  16. Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
    Alta · 7.7 CVE-2026-59216 < 0.10.0 0.10.0
  17. Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
    Alta · 7.1 CVE-2026-59714 >= 0.9.5, < 0.10.0 0.10.0
  18. Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
    Alta · 7.1 CVE-2026-59219 >= 0.9.0, < 0.10.0 0.10.0
  19. Open WebUI: Stored web worker XSS via Pyodide
    Alta · 7.3 CVE-2026-59214 < 0.10.0 0.10.0
  20. Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
    Alta · 7.3 CVE-2026-26193 < 0.6.44 0.6.44
  21. Open WebUI vulnerable to Stored XSS via iFrame in citations model
    Alta · 7.3 CVE-2026-26192 < 0.7.0 0.7.0
  22. Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
    Alta CVE-2025-46719 < 0.6.6 0.6.6
  23. Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
    Alta · 7.7 CVE-2026-54018 < 0.9.6 0.9.6
  24. Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
    Alta · 7.7 CVE-2026-54017 < 0.9.6 0.9.6
  25. Open WebUI: Stored XSS to Account Takeover via Model Profile Images
    Alta · 7.6 CVE-2026-54013 < 0.9.6 0.9.6
  26. Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
    Alta · 7.1 CVE-2026-54012 < 0.9.6 0.9.6
  27. Open WebUI: Stored XSS in Mermaid Markdown Preview
    Alta · 8.7 CVE-2026-54011 < 0.9.6 0.9.6
  28. Open WebUI: Forged chat-file link allows cross-user file read and deletion
    Alta · 8.3 CVE-2026-54010 < 0.9.6 0.9.6
  29. Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
    Alta · 8.5 CVE-2026-54008 < 0.9.6 0.9.6
  30. Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
    Alta · 6.5 CVE-2026-54007 < 0.9.6 0.9.6
  31. Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
    Alta · 8.1 CVE-2026-45675 < 0.9.0 0.9.0
  32. Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
    Alta · 8.8 CVE-2026-45672 < 0.8.12 0.8.12
  33. Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
    Alta · 8.0 CVE-2026-45671 < 0.9.0 0.9.0
  34. Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
    Alta · 8.1 CVE-2026-45402 < 0.9.5 0.9.5
  35. Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
    Alta · 7.3 CVE-2026-56398 < 0.9.5 0.9.5
  36. Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
    Alta · 8.5 CVE-2026-45401 < 0.9.5 0.9.5
  37. Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
    Alta · 8.5 CVE-2026-45400 < 0.9.5 0.9.5
  38. Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
    Alta · 7.1 CVE-2026-45399 < 0.9.0 0.9.0
  39. Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
    Alta · 7.5 CVE-2026-45398 < 0.9.5 0.9.5
  40. Open WebUI's chat completion API allows tool restrictions to be bypassed
    Alta · 7.1 CVE-2026-45350 < 0.8.6 0.8.6
  41. Open WebUI has Broken Access Control for Completions API
    Alta · 7.1 CVE-2026-45349 < 0.9.0 0.9.0
  42. Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
    Alta · 7.7 CVE-2026-45338 < 0.9.0 0.9.0
  43. Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
    Alta · 8.5 CVE-2026-45331 < 0.9.0 0.9.0
  44. Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
    Alta · 6.1 CVE-2026-45314 < 0.9.3 0.9.3
  45. Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
    Alta · 8.7 CVE-2026-45315 < 0.9.3 0.9.3
  46. Open WebUI has stored XSS via the HTML renedering view
    Alta · 7.7 CVE-2026-45303 < 0.6.5 0.6.5
  47. Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
    Alta · 8.1 CVE-2026-45301 < 0.3.16 0.3.16
  48. Open WebUI has inconsistent authorization controls within memories API
    Alta · 8.3 CVE-2026-44570 < 0.6.19 0.6.19
  49. Open WebUI's Insecure Message Access Breaks Authorization
    Alta · 7.1 CVE-2026-44569 < 0.6.19 0.6.19
  50. Open WebUI Arbitrary File Write, Delete via Path Traversal
    Alta · 8.1 CVE-2026-44565 < 0.6.10 0.6.10
  51. Open WebUI has a CORS misconfiguration and session validation issue
    Alta · 8.3 CVE-2026-56400 < 0.3.33 0.3.33
  52. Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
    Alta · 7.3 CVE-2026-44566 < 0.1.124 0.1.124
  53. Open WebUI has Improper Authorization Control
    Alta · 7.3 CVE-2026-44567 < 0.1.124 0.1.124
  54. Open WebUI has stored XSS in Excel file preview
    Alta · 7.3 CVE-2026-44549 < 0.8.0 0.8.0
  55. Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
    Alta · 8.1 CVE-2026-44554 < 0.9.0 0.9.0
  56. Open WebUI's responses passthrough endpoint lacks access control authorization
    Alta · 7.1 CVE-2026-44556 < 0.9.0 0.9.0
  57. Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
    Alta · 7.6 CVE-2026-44555 < 0.9.0 0.9.0
  58. Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
    Alta · 8.7 CVE-2026-44552 < 0.9.0 0.9.0
  59. Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
    Alta · 8.1 CVE-2026-44553 < 0.9.0 0.9.0
  60. Open WebUI has an LDAP Empty Password Authentication Bypass
    Crítica · 9.1 CVE-2026-44551 < 0.9.0 0.9.0
  61. open-webui Vulnerable to Stored XSS via Model Description
    Alta · 7.3 CVE-2026-44721 < 0.9.0 0.9.0
Mostrar más (18) Mostrando 61 de 79

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.