Open WebUI vulnerabilities

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator. Users can submit rules that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can trigger requests carrying configured API keys, read version strings, and enumerate connections.

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.

Open WebUI versions from 0.6.33 before 0.11.4 contain a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.

In Open WebUI prior to version 0.8.6, there is a vulnerability in the chat completion API that allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access.

In Open WebUI prior to version 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the _process_picture_url() function, allowing an attacker to force the server to make HTTP requests to internal resources.

Open WebUI prior to version 0.9.3 has a vulnerability that allows audio files with HTML extensions to be uploaded, potentially leading to the execution of malicious code in users' browsers. A user with the appropriate permissions can trick others into opening a malicious link.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.5 allowed for script injection and execution through the HTML rendering view. The chat content was embedded in an iFrame with sandbox restrictions that were largely ineffective.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.3.16 had a missing permission check in files related to API endpoints. This allowed any authenticated user to list, access, and delete every file uploaded by other users.

In Open WebUI prior to version 0.6.19, there were inconsistencies in authorization controls surrounding the memories API, allowing standard users to delete, restore, and view the contents of other users' memories.

In Open WebUI prior to version 0.6.19, there is an IDOR vulnerability in the channels message management system that allows authenticated users to modify or delete any message within channels they have access to. The issue arises from a lack of message ownership validation in the message update and delete endpoints.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.1.124 did not properly validate whether a user has an authorized role. By default, when new user sign-ups are enabled, the user role is set to 'pending', requiring administrator intervention to assign the appropriate role.

Open WebUI is an artificial intelligence platform that prior to version 0.1.124 did not validate or sanitize file names uploaded by users. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended upload directory.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.10 did not validate or sanitize file names when uploading audio files. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended uploads directory.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.8.0 previewed Excel file attachments in an unsafe manner. A crafted XLSX file payload could exploit the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.8.12 allowed any verified user to execute arbitrary Python code, even when the admin set ENABLE_CODE_EXECUTION=false. The API endpoint did not enforce this configuration, leading to unauthorized code execution.

In versions prior to 0.9.5, the validate_url() function in Open WebUI does not validate HTTP 3xx redirects, allowing authenticated users to access internal IP addresses via public URLs. This may lead to unauthorized reading of data from internal resources.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.9.5, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability.

In Open WebUI prior to version 0.9.5, a vulnerability allows authenticated users to access private knowledge bases by knowing the UUID. This flaw also enables attackers to inject or overwrite content in other users' knowledge bases.

Open WebUI is an artificial intelligence platform that prior to version 0.9.5 did not check tool management permissions during tool updates. This allows users who have been denied permissions to replace the server-side Python content of a tool, potentially leading to unauthorized code execution.

Open WebUI prior to version 0.9.0 contained an XSS vulnerability that allowed authenticated users with model creation permissions to execute arbitrary JavaScript in the browsers of other users, including admins, who viewed the malicious model in the chat UI.

In Open WebUI prior to version 0.9.0, any authenticated user could permanently delete files owned by other users via DELETE /api/v1/files/{id} if the target file was referenced in any shared chat. The has_access_to_file() authorization gate did not check the requesting user's identity or the type of operation being performed.

Open WebUI is an artificial intelligence platform that, prior to version 0.9.0, allowed authenticated users with low privileges to enumerate active background tasks and stop tasks belonging to other users. This represents a serious authorization vulnerability affecting integrity and usability in multi-user environments.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.0 allowed users to continue another user's conversation using their Chat ID and their own API key.

In versions prior to 0.9.0 of the Open WebUI platform, the validate_url() function improperly validates IPv6 addresses, allowing any address to pass through the filter. Additionally, IPv4-mapped IPv6 addresses and several reserved IPv4 ranges are not blocked.

In versions prior to 0.9.0, the /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests to LLM providers without enforcing per-model access control. This allows any authenticated user to interact with any model configured on the instance.

Open WebUI prior to version 0.9.0 has a vulnerability that allows users with default model creation permissions to create chained models referencing restricted base models. Access verification for base models is not performed, enabling unauthorized access.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.0 did not verify user permissions for modifying data collections. The POST /api/v1/retrieval/process/web endpoint accepted parameters that could lead to unauthorized deletion of data collections.

Open WebUI is an offline AI platform that prior to version 0.9.0 did not update the session pool after administrative role changes and user deletions. A user whose admin role was revoked retained admin privileges within their existing Socket.IO session as long as they kept the connection alive.

In versions prior to 0.9.0 of Open WebUI, the tool_servers and terminal_servers keys in utils/tools.py do not use a prefix, leading to key collisions when multiple instances share a Redis database. This can result in one instance overwriting the tool server configuration of another instance.

In versions prior to 0.9.0 of the Open WebUI platform, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password as a string with no minimum length requirement, allowing an empty string to pass validation.

Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that runs JavaScript in viewers' browsers, enabling in-app phishing, or session hijacking where iframeSandboxAllowSameOrigin is enabled.

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call.

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.

Open WebUI versions from 0.11.1 before 0.11.4 contain a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.

Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. This issue is fixed in version 0.11.1.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this endpoint. This issue is fixed in version 0.9.0.

Open WebUI from 0.5.0 to 0.11.1 has a vulnerability causing infinite loop in the message-chain reconstruction helper in backend/open_webui/utils/misc.py. An authenticated user can store id-less messages in a cyclic structure, blocking the event loop and growing memory until termination. Fixed in 0.11.1.

Open WebUI from 0.9.5 to 0.11.1 fails to reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled. An authenticated user can redirect fetches to excluded hosts, loopback, private networks, or cloud metadata services, and route content into various features. Fixed in 0.11.1.