Medium
CVE-2026-54015
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 161
Reset filters
High
CVE-2026-54007
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Medium
CVE-2026-54006
Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
High
CVE-2026-45675
Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
High
CVE-2026-45672
Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
High
CVE-2026-45671
Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
Medium
CVE-2026-45365
Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]
High
CVE-2026-45401
Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
Medium
CVE-2026-45396
Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation
Medium
CVE-2026-45386
Open WebUI has an IDOR vulnerability in the pin_channel_message API endpoint
Medium
CVE-2026-45397
Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure
High
CVE-2026-45402
Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
Medium
CVE-2026-45667
Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)
Medium
CVE-2026-45387
Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)
High
CVE-2026-45400
Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
High
CVE-2026-45399
Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
Medium
CVE-2026-45351
Open WebUI Exposes System Prompt to Regular User [Non-Admin]
Medium
CVE-2026-45666
Open WebUI has an Indirect Object Reference (IDOR) in user notes
Medium
CVE-2026-45385
Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint
High
CVE-2026-45398
Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
High
CVE-2026-45314
Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
High
CVE-2026-45338
Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
High
CVE-2026-45331
Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
High
CVE-2026-45315
Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.