CVE Vulnerability Catalog

Open WebUI prior to version 0.9.5 has a vulnerability that allows users to attach files to resources they do not have permission for, potentially leading to the exfiltration of other users' private files.

In versions prior to 0.9.5, the validate_url() function in Open WebUI does not validate HTTP 3xx redirects, allowing authenticated users to access internal IP addresses via public URLs. This may lead to unauthorized reading of data from internal resources.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.9.5, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability.

In Open WebUI prior to version 0.9.5, a vulnerability allows authenticated users to access private knowledge bases by knowing the UUID. This flaw also enables attackers to inject or overwrite content in other users' knowledge bases.

Open WebUI is an artificial intelligence platform that prior to version 0.9.5 did not check tool management permissions during tool updates. This allows users who have been denied permissions to replace the server-side Python content of a tool, potentially leading to unauthorized code execution.

Open WebUI prior to version 0.9.0 contained an XSS vulnerability that allowed authenticated users with model creation permissions to execute arbitrary JavaScript in the browsers of other users, including admins, who viewed the malicious model in the chat UI.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.0 had a vulnerability in the LDAP and OAuth authentication flows. They used a TOCTOU pattern, which could lead to unauthorized assignment of the admin role to the first user.

In Open WebUI prior to version 0.9.0, any authenticated user could permanently delete files owned by other users via DELETE /api/v1/files/{id} if the target file was referenced in any shared chat. The has_access_to_file() authorization gate did not check the requesting user's identity or the type of operation being performed.

Open WebUI is an artificial intelligence platform that, prior to version 0.9.0, allowed authenticated users with low privileges to enumerate active background tasks and stop tasks belonging to other users. This represents a serious authorization vulnerability affecting integrity and usability in multi-user environments.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.0 allowed users to continue another user's conversation using their Chat ID and their own API key.

In versions prior to 0.9.0 of the Open WebUI platform, the validate_url() function improperly validates IPv6 addresses, allowing any address to pass through the filter. Additionally, IPv4-mapped IPv6 addresses and several reserved IPv4 ranges are not blocked.

In versions prior to 0.9.0, the /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests to LLM providers without enforcing per-model access control. This allows any authenticated user to interact with any model configured on the instance.

Open WebUI prior to version 0.9.0 has a vulnerability that allows users with default model creation permissions to create chained models referencing restricted base models. Access verification for base models is not performed, enabling unauthorized access.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.0 did not verify user permissions for modifying data collections. The POST /api/v1/retrieval/process/web endpoint accepted parameters that could lead to unauthorized deletion of data collections.

Open WebUI is an offline AI platform that prior to version 0.9.0 did not update the session pool after administrative role changes and user deletions. A user whose admin role was revoked retained admin privileges within their existing Socket.IO session as long as they kept the connection alive.

In versions prior to 0.9.0 of Open WebUI, the tool_servers and terminal_servers keys in utils/tools.py do not use a prefix, leading to key collisions when multiple instances share a Redis database. This can result in one instance overwriting the tool server configuration of another instance.

Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by sending a crafted packet.

Vvveb is a powerful and easy to use content management system (CMS) that had a vulnerability in the checkout endpoint prior to version 1.0.8.3. It allowed logged-in attackers to reuse another user's cart data in their own checkout session.

Vvveb is a powerful and easy to use content management system (CMS) that prior to version 1.0.8.3 allowed an authenticated administrator to load another administrator's API token list by supplying that user's admin_id. This can disclose sensitive API tokens belonging to other administrators.

phpMyFAQ before version 4.1.2 contains a stored cross-site scripting vulnerability in the Utils::parseUrl() function. This allows authenticated users to inject JavaScript via malformed URLs in comments.