Open WebUI vulnerabilities

In Open WebUI from version 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True, and the ydoc:awareness:update and ydoc:document:leave handlers accept collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state.

In Open WebUI from version 0.8.11 before 0.10.0, the POST /api/v1/images/edit endpoint only required a verified account but did not enforce the global image-edit switch or per-user image-generation permission. This allowed a non-admin user to invoke server-side image editing with administrator-configured provider credentials.

A vulnerability in Open WebUI versions from 0.9.0 before 0.10.0 allows deactivated users to continue scheduled model execution. The execute_automation function rehydrated automation owners without rechecking their activity status, and check_model_access only enforced private-model grants for the exact user role.

In Open WebUI from version 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can bypass access control to a restricted underlying model via task endpoints like /api/v1/tasks/moa/completions. The normal chat route checks the arena model before dispatching, while the task route calls generate_chat_completion() directly with bypass_filter=True, skipping the submodel's access check.

In Open WebUI prior to 0.10.0, the WebSocket terminal URL was built from an unencoded session_id, allowing query injection to impersonate another user. The HTTP proxy also forwarded X-User-Id without integrity checks, enabling identity manipulation.

In Open WebUI prior to version 0.10.0, the WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings, allowing bypass of blocklists via path-based entries (e.g., !internal.example.com) and sibling-domain matches that did not reflect the intended hostname policy.

A vulnerability in Open WebUI versions 0.7.0 through 0.10.0 allows a regular channel participant to retrieve sensitive settings of other users, including API keys and webhook configurations, via a GET request to /api/v1/channels//members. The issue is fixed in version 0.10.0.

A vulnerability in Open WebUI before version 0.10.0 allowed a ReDoS (Regular Expression Denial of Service) attack by sending a specially crafted chat message containing <$ without a closing >. The SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py caused quadratic backtracking, blocking the asyncio event loop.

In Open WebUI before version 0.10.0 with Redis configured, real-time connection authentication (Socket.IO, WebSocket) used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating.

In Open WebUI prior to version 0.10.0, the /api/v1/auths/signin endpoint allowed account enumeration via timing side-channel. Requests for registered users were measurably slower (due to bcrypt verification) than for non-existent emails, enabling unauthenticated attackers to enumerate valid accounts.

In Open WebUI prior to version 0.10.0, the file upload path accepted the metadata.knowledge_id parameter and automatically linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing read-only knowledge-base users to add arbitrary files.

A vulnerability in Open WebUI before version 0.10.0 allows authenticated users to execute Python code or tools in another user's session. An attacker can exploit Socket.IO events to hijack a victim's session after learning their socket ID.

In Open WebUI prior to version 0.10.0, a vulnerability exists where channel thread parent and reply handling did not bind parent_id to the channel in the URL. This allows an authenticated user to reference a message from another private or DM channel and disclose thread context across channels.

Open WebUI prior to 0.10.0 runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads using pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools.

In Open WebUI versions from 0.6.27 before 0.10.0, the get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to the aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry. This exposes one user's model list to another caller during the TTL window.

In Open WebUI before version 0.10.0, the _verify_knowledge_file_access function only checked read permissions, while file write and delete routes later trusted permissions derived from the writable model meta.knowledge object. This allowed a user with read-only knowledge file access to gain file write or delete capabilities.

An SSRF vulnerability in Open WebUI before version 0.6.27 in the /api/v1/retrieval/process/web endpoint allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.

In Open WebUI prior to version 0.8.11, there is a vulnerability that allows an attacker to bypass authorization checks when joining a document room. By manipulating the document identifier, the attacker can access the victim's private note contents.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.6 added collection-level ACL checks. However, in Milvus multitenancy mode, these checks can be bypassed, leading to potential unauthorized access to resources.

Open WebUI is an artificial intelligence platform that prior to version 0.9.6 had a vulnerability in the validate_url function in SafePlaywrightURLLoader, allowing SSRF attacks. The URL validation was only performed on the initial URL, enabling attackers to bypass protections using HTTP redirects.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.6 had a Broken Object Level Authorization (BOLA) vulnerability in the search_knowledge_files tool. This allows an authenticated user to access metadata from private or restricted knowledge base files without proper permissions.

Open WebUI prior to version 0.9.6 has a vulnerability that allows authenticated users to access the private prompt history of other users. The issues occur in the version history endpoints that do not verify if the history entry belongs to the correct prompt.

In Open WebUI prior to version 0.9.6, a path traversal vulnerability exists in the cache file serving endpoint that allows authenticated users to read files from sibling directories outside the intended cache directory.

Open WebUI prior to version 0.9.6 allows users to store arbitrary meta.knowledge entries in models without checking file permissions. This enables malicious model owners to access private files of other users.

Open WebUI prior to version 0.9.6 renders Mermaid blocks from Markdown files in the file preview panel, allowing for the injection of malicious JavaScript code into the DOM. Due to the securityLevel: 'loose' setting, attacker-controlled content can be rendered unsafely.

Open WebUI is an artificial intelligence platform that, prior to version 0.9.6, allowed authenticated users to attach arbitrary file_id values to their chat messages without verifying ownership. This enables attackers to access victim files by sharing the chat.

In Open WebUI prior to version 0.9.6, a vulnerability allows an authenticated user to access other users' files by manipulating the image_url.url parameter in the POST /api/chat/completions request. If this value does not start with http://, https://, or data:image/, it is interpreted as a file id, allowing access to the file content without permission checks.

In Open WebUI prior to version 0.9.6, a vulnerability allows an attacker with a valid OAuth identity to submit a public URL that redirects to an internal address. This enables the attacker to read the internal response from their own profile_image_url field.

In Open WebUI prior to version 0.9.6, there is a vulnerability that allows regular user-role accounts to move events between other users' calendars without proper permissions. This vulnerability stems from the lack of validation of the destination calendar_id in the event update request.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.0 had a vulnerability in the LDAP and OAuth authentication flows. They used a TOCTOU pattern, which could lead to unauthorized assignment of the admin role to the first user.