CVE-2026-109299

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator. Users can submit rules that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can trigger requests carrying configured API keys, read version strings, and enumerate connections.

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.

Open WebUI versions from 0.6.33 before 0.11.4 contain a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.

In Open WebUI prior to version 0.8.6, there is a vulnerability in the chat completion API that allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access.

In Open WebUI prior to version 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the _process_picture_url() function, allowing an attacker to force the server to make HTTP requests to internal resources.

Open WebUI prior to version 0.9.3 has a vulnerability that allows audio files with HTML extensions to be uploaded, potentially leading to the execution of malicious code in users' browsers. A user with the appropriate permissions can trick others into opening a malicious link.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.5 allowed for script injection and execution through the HTML rendering view. The chat content was embedded in an iFrame with sandbox restrictions that were largely ineffective.