Security advisories

high2026-08-04

CVE-2026-70492-Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

open-webui/open-webui · GHSA-pwxh-7358-jq2x

medium2026-08-04

CVE-2026-70491-Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

open-webui/open-webui · GHSA-3r7g-q6cg-q2vx

medium2026-08-04

CVE-2026-70490-Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

open-webui/open-webui · GHSA-5gpj-vj23-vhhv

medium2026-08-04

CVE-2026-70489-Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

open-webui/open-webui · GHSA-73cq-mcgh-379c

medium2026-08-04

CVE-2026-54020-Open WebUI: DNS Rebinding SSRF Bypass

open-webui/open-webui · GHSA-h6x2-583h-x99r

medium2026-08-04

CVE-2026-70487-Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

open-webui/open-webui · GHSA-6xhv-rxhv-pwm4

medium2026-08-04

CVE-2026-70488-Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

open-webui/open-webui · GHSA-jxc9-xmc4-gr23

high2026-08-04

CVE-2026-70486-Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

open-webui/open-webui · GHSA-3xpf-xq7r-v8c5

high2026-08-04

CVE-2026-70485-Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

open-webui/open-webui · GHSA-8x5v-cpv7-8jjp

medium2026-08-04

CVE-2026-70484-Open WebUI: Users denied the image-generation permission can still generate images via chat completions

open-webui/open-webui · GHSA-g423-grf7-98rv

medium2026-08-04

CVE-2026-70480-Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

open-webui/open-webui · GHSA-rffm-9q57-q649

low2026-08-04

CVE-2026-70483-Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

open-webui/open-webui · GHSA-3vf6-64vr-3g56

high2026-08-04

CVE-2026-70482-Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

open-webui/open-webui · GHSA-rq84-p6rr-vf89

medium2026-08-04

CVE-2026-70481-Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

open-webui/open-webui · GHSA-mj5r-jf49-m3w7

high2026-08-04

CVE-2026-70479-Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

open-webui/open-webui · GHSA-w2rx-84hp-gg95

critical2026-08-04

CVE-2026-70478-Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

flowiseai/flowise · GHSA-qgvm-j2hm-6m38

critical2026-08-04

CVE-2026-70477-Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

flowiseai/flowise · GHSA-5xvg-pmgg-3mxr

high2026-08-04

CVE-2026-70476-Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

flowiseai/flowise · GHSA-gmmw-qg98-6j6p

medium2026-08-04

Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

flowiseai/flowise · GHSA-8gj2-2cvc-6xx7

high2026-08-04

CVE-2026-70475-Flowise: Missing Authorization on Execution Update Endpoint

flowiseai/flowise · GHSA-fm2f-4339-4p2f