Iniciar sesión
Deutsch English Español Polski
Media

Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

  • Publicada: 14.05.2026
  • Actualizado: 11.10.2026 14:17

Summary

When setting model permissions so that a group has read access to it, intending for other users to use it, those users also can read the model's system prompt.

However users may consider their system prompt confidential, so we consider this a security issue.

Compare https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/ or prompt injections to get popular chatbots on the internet to reveal their prompt.

Details

We discovered that users can open the workspace model edit page /workspace/models/edit?id=notmymodel for models that do not appear in their workspace.

Saving is not possible, that permission check is correct.

On the API level:

  • /api/v1/models/model?id=notmymodel -> returns the model details, most importantly params.system
  • even though /api/v1/models/list does NOT contain the model since it checks for write permission.
  • /api/models contains the model correctly and does not reveal the system prompt.

It seems inconsistent that the REST API list does not contain an item, but if you know the id, you can access it anyway.

PoC

  • create model
  • give read permission to group with another user
  • other user can access /api/v1/models/model?id=notmymodel

Impact

System prommpt leakage

If this is intended behavior for the "read" permission, maybe there should be an additional "use" permission (which would be 99% of use cases of the read permission i believe).

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) open-webui < 0.9.5 0.9.5

Referencias

Puntuación CVSS 4.3/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Debilidad (CWE)
CWE-200
Plataforma
Python (PyPI)
Paquete
open-webui
Publicada
14.05.2026
Actualizado
11.10.2026 14:17

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-2728 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-h2cw-7qw9-56xr - CC BY 4.0

Historial de vulnerabilidades: open-webui

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (161) en el archivo
Entradas en total
161
Primera → última
08.2024 09.2026
Sin corrección
11
Explotada en ataques
0

Distribución por gravedad

  • Crítica 1
  • Alta 77
  • Media 75
  • Baja 8

Divulgaciones por año

Gravedad:
  1. Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
    Alta · 7.5 CVE-2026-87011 >= 0.9.0, < 0.11.1 0.11.1
  2. Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
    Alta · 8.1 CVE-2026-87016 >= 0.6.41, < 0.11.1 0.11.1
  3. Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
    Alta · 8.7 CVE-2026-87995 >= 0.8.11, < 0.11.1 0.11.1
  4. Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
    Alta · 7.7 CVE-2026-87996 >= 0.9.6, < 0.11.1 0.11.1
  5. Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
    Alta · 7.1 CVE-2026-87998 >= 0.10.0, < 0.11.1 0.11.1
  6. Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
    Alta · 7.1 CVE-2026-87999 < 0.11.1 0.11.1
  7. Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
    Alta · 8.1 CVE-2026-70494 >= 0.10.0, < 0.11.0 0.11.0
  8. Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
    Alta · 8.7 CVE-2026-70492 >= 0.10.0, < 0.11.0 0.11.0
  9. Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
    Alta · 8.2 CVE-2026-70486 >= 0.9.0, < 0.11.0 0.11.0
  10. Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
    Alta · 7.1 CVE-2026-70485 >= 0.9.0, < 0.11.0 0.11.0
  11. Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
    Alta · 8.1 CVE-2026-70482 >= 0.8.0, < 0.11.0 0.11.0
  12. Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
    Alta · 7.7 CVE-2026-70479 >= 0.9.6, < 0.11.0 0.11.0
  13. open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
    Alta · 7.7 CVE-2026-59221 >= 0.9.6, < 0.10.0 0.10.0
  14. Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
    Alta · 8.0 CVE-2026-59224 < 0.10.0 0.10.0
  15. Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
    Alta · 7.7 CVE-2026-59216 < 0.10.0 0.10.0
  16. Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
    Alta · 7.1 CVE-2026-59714 >= 0.9.5, < 0.10.0 0.10.0
  17. Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
    Alta · 7.1 CVE-2026-59219 >= 0.9.0, < 0.10.0 0.10.0
  18. Open WebUI: Stored web worker XSS via Pyodide
    Alta · 7.3 CVE-2026-59214 < 0.10.0 0.10.0
  19. Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
    Alta · 7.3 CVE-2026-26193 < 0.6.44 0.6.44
  20. Open WebUI vulnerable to Stored XSS via iFrame in citations model
    Alta · 7.3 CVE-2026-26192 < 0.7.0 0.7.0
  21. Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
    Alta CVE-2025-46719 < 0.6.6 0.6.6
  22. Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
    Alta · 7.7 CVE-2026-54018 < 0.9.6 0.9.6
  23. Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
    Alta · 7.7 CVE-2026-54017 < 0.9.6 0.9.6
  24. Open WebUI: Stored XSS to Account Takeover via Model Profile Images
    Alta · 7.6 CVE-2026-54013 < 0.9.6 0.9.6
  25. Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
    Alta · 7.1 CVE-2026-54012 < 0.9.6 0.9.6
  26. Open WebUI: Stored XSS in Mermaid Markdown Preview
    Alta · 8.7 CVE-2026-54011 < 0.9.6 0.9.6
  27. Open WebUI: Forged chat-file link allows cross-user file read and deletion
    Alta · 8.3 CVE-2026-54010 < 0.9.6 0.9.6
  28. Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
    Alta · 8.5 CVE-2026-54008 < 0.9.6 0.9.6
  29. Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
    Alta · 6.5 CVE-2026-54007 < 0.9.6 0.9.6
  30. Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
    Alta · 8.1 CVE-2026-45675 < 0.9.0 0.9.0
  31. Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
    Alta · 8.8 CVE-2026-45672 < 0.8.12 0.8.12
  32. Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
    Alta · 8.0 CVE-2026-45671 < 0.9.0 0.9.0
  33. Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
    Alta · 8.1 CVE-2026-45402 < 0.9.5 0.9.5
  34. Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
    Alta · 7.3 CVE-2026-56398 < 0.9.5 0.9.5
  35. Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
    Alta · 8.5 CVE-2026-45401 < 0.9.5 0.9.5
  36. Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
    Alta · 8.5 CVE-2026-45400 < 0.9.5 0.9.5
  37. Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
    Alta · 7.1 CVE-2026-45399 < 0.9.0 0.9.0
  38. Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
    Alta · 7.5 CVE-2026-45398 < 0.9.5 0.9.5
  39. Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage) esta entrada
    Media · 4.3 CVE-2026-45387 < 0.9.5 0.9.5
  40. Open WebUI's chat completion API allows tool restrictions to be bypassed
    Alta · 7.1 CVE-2026-45350 < 0.8.6 0.8.6
  41. Open WebUI has Broken Access Control for Completions API
    Alta · 7.1 CVE-2026-45349 < 0.9.0 0.9.0
  42. Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
    Alta · 7.7 CVE-2026-45338 < 0.9.0 0.9.0
  43. Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
    Alta · 8.5 CVE-2026-45331 < 0.9.0 0.9.0
  44. Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
    Alta · 6.1 CVE-2026-45314 < 0.9.3 0.9.3
  45. Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
    Alta · 8.7 CVE-2026-45315 < 0.9.3 0.9.3
  46. Open WebUI has stored XSS via the HTML renedering view
    Alta · 7.7 CVE-2026-45303 < 0.6.5 0.6.5
  47. Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
    Alta · 8.1 CVE-2026-45301 < 0.3.16 0.3.16
  48. Open WebUI has inconsistent authorization controls within memories API
    Alta · 8.3 CVE-2026-44570 < 0.6.19 0.6.19
  49. Open WebUI's Insecure Message Access Breaks Authorization
    Alta · 7.1 CVE-2026-44569 < 0.6.19 0.6.19
  50. Open WebUI Arbitrary File Write, Delete via Path Traversal
    Alta · 8.1 CVE-2026-44565 < 0.6.10 0.6.10
  51. Open WebUI has a CORS misconfiguration and session validation issue
    Alta · 8.3 CVE-2026-56400 < 0.3.33 0.3.33
  52. Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
    Alta · 7.3 CVE-2026-44566 < 0.1.124 0.1.124
  53. Open WebUI has Improper Authorization Control
    Alta · 7.3 CVE-2026-44567 < 0.1.124 0.1.124
  54. Open WebUI has stored XSS in Excel file preview
    Alta · 7.3 CVE-2026-44549 < 0.8.0 0.8.0
  55. Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
    Alta · 8.1 CVE-2026-44554 < 0.9.0 0.9.0
  56. Open WebUI's responses passthrough endpoint lacks access control authorization
    Alta · 7.1 CVE-2026-44556 < 0.9.0 0.9.0
  57. Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
    Alta · 7.6 CVE-2026-44555 < 0.9.0 0.9.0
  58. Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
    Alta · 8.7 CVE-2026-44552 < 0.9.0 0.9.0
  59. Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
    Alta · 8.1 CVE-2026-44553 < 0.9.0 0.9.0
  60. Open WebUI has an LDAP Empty Password Authentication Bypass
    Crítica · 9.1 CVE-2026-44551 < 0.9.0 0.9.0
Mostrar más (19) Mostrando 60 de 79

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.