https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-88006.htmlhttps://patchthecve.com/cve/CVE-2026-88006.htmlFri, 18 Sep 2026 14:43:56 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose prohttps://patchthecve.com/cve/CVE-2026-88005.htmlhttps://patchthecve.com/cve/CVE-2026-88005.htmlFri, 18 Sep 2026 14:44:04 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account https://patchthecve.com/cve/CVE-2026-88002.htmlhttps://patchthecve.com/cve/CVE-2026-88002.htmlMon, 14 Sep 2026 19:56:27 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id fielhttps://patchthecve.com/cve/CVE-2026-88001.htmlhttps://patchthecve.com/cve/CVE-2026-88001.htmlMon, 14 Sep 2026 19:56:01 +0000MEDIUM 5.0: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled. An authenticated usehttps://patchthecve.com/cve/CVE-2026-88000.htmlhttps://patchthecve.com/cve/CVE-2026-88000.htmlMon, 14 Sep 2026 17:48:49 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-history deletion helper in backend/open_webui/models/chats.py to follow childrenIds without recording visited message identifihttps://patchthecve.com/cve/CVE-2026-87999.htmlhttps://patchthecve.com/cve/CVE-2026-87999.htmlWed, 16 Sep 2026 15:13:49 +0000HIGH 7.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof thathttps://patchthecve.com/cve/CVE-2026-87998.htmlhttps://patchthecve.com/cve/CVE-2026-87998.htmlWed, 16 Sep 2026 15:14:19 +0000HIGH 7.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection https://patchthecve.com/cve/CVE-2026-87997.htmlhttps://patchthecve.com/cve/CVE-2026-87997.htmlWed, 16 Sep 2026 15:14:39 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access checkhttps://patchthecve.com/cve/CVE-2026-87996.htmlhttps://patchthecve.com/cve/CVE-2026-87996.htmlWed, 16 Sep 2026 15:14:48 +0000HIGH 7.7: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and asynhttps://patchthecve.com/cve/CVE-2026-87995.htmlhttps://patchthecve.com/cve/CVE-2026-87995.htmlWed, 16 Sep 2026 15:14:57 +0000HIGH 8.7: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy servehttps://patchthecve.com/cve/CVE-2026-87994.htmlhttps://patchthecve.com/cve/CVE-2026-87994.htmlWed, 16 Sep 2026 15:15:32 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id but did not verify that the calling user auhttps://patchthecve.com/cve/CVE-2026-87017.htmlhttps://patchthecve.com/cve/CVE-2026-87017.htmlWed, 16 Sep 2026 15:23:05 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filterhttps://patchthecve.com/cve/CVE-2026-87016.htmlhttps://patchthecve.com/cve/CVE-2026-87016.htmlTue, 15 Sep 2026 15:29:13 +0000HIGH 8.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth suhttps://patchthecve.com/cve/CVE-2026-87015.htmlhttps://patchthecve.com/cve/CVE-2026-87015.htmlTue, 15 Sep 2026 15:54:14 +0000MEDIUM 6.8: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached anhttps://patchthecve.com/cve/CVE-2026-87014.htmlhttps://patchthecve.com/cve/CVE-2026-87014.htmlTue, 15 Sep 2026 15:56:08 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by bachttps://patchthecve.com/cve/CVE-2026-87013.htmlhttps://patchthecve.com/cve/CVE-2026-87013.htmlTue, 15 Sep 2026 16:09:34 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/{id} and POST /ahttps://patchthecve.com/cve/CVE-2026-87012.htmlhttps://patchthecve.com/cve/CVE-2026-87012.htmlTue, 15 Sep 2026 16:17:55 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar event meta.alert_minutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An https://patchthecve.com/cve/CVE-2026-87011.htmlhttps://patchthecve.com/cve/CVE-2026-87011.htmlTue, 15 Sep 2026 16:26:18 +0000HIGH 7.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout tokhttps://patchthecve.com/cve/CVE-2026-70494.htmlhttps://patchthecve.com/cve/CVE-2026-70494.htmlFri, 18 Sep 2026 14:45:25 +0000HIGH 8.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages belonghttps://patchthecve.com/cve/CVE-2026-70493.htmlhttps://patchthecve.com/cve/CVE-2026-70493.htmlFri, 18 Sep 2026 14:45:36 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files. https://patchthecve.com/cve/CVE-2026-70492.htmlhttps://patchthecve.com/cve/CVE-2026-70492.htmlFri, 18 Sep 2026 14:47:07 +0000HIGH 8.7: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. The chttps://patchthecve.com/cve/CVE-2026-70491.htmlhttps://patchthecve.com/cve/CVE-2026-70491.htmlFri, 18 Sep 2026 14:47:15 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py returned full Python tool source to authenticated non-admin readhttps://patchthecve.com/cve/CVE-2026-70490.htmlhttps://patchthecve.com/cve/CVE-2026-70490.htmlFri, 18 Sep 2026 14:47:24 +0000MEDIUM 6.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that get_verified_user enforceshttps://patchthecve.com/cve/CVE-2026-70489.htmlhttps://patchthecve.com/cve/CVE-2026-70489.htmlFri, 18 Sep 2026 14:57:16 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to fhttps://patchthecve.com/cve/CVE-2026-70488.htmlhttps://patchthecve.com/cve/CVE-2026-70488.htmlFri, 18 Sep 2026 14:57:29 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objects https://patchthecve.com/cve/CVE-2026-70487.htmlhttps://patchthecve.com/cve/CVE-2026-70487.htmlFri, 18 Sep 2026 14:57:56 +0000MEDIUM 5.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file id chttps://patchthecve.com/cve/CVE-2026-54020.htmlhttps://patchthecve.com/cve/CVE-2026-54020.htmlFri, 18 Sep 2026 14:58:07 +0000MEDIUM 6.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticated https://patchthecve.com/cve/CVE-2026-70486.htmlhttps://patchthecve.com/cve/CVE-2026-70486.htmlFri, 18 Sep 2026 14:46:56 +0000HIGH 8.2: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user with https://patchthecve.com/cve/CVE-2026-70485.htmlhttps://patchthecve.com/cve/CVE-2026-70485.htmlFri, 18 Sep 2026 14:46:45 +0000HIGH 7.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in trahttps://patchthecve.com/cve/CVE-2026-70484.htmlhttps://patchthecve.com/cve/CVE-2026-70484.htmlFri, 18 Sep 2026 14:46:37 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied image_generation flag and did not re-check the features.image_generation permission that the direct image routes and nathttps://patchthecve.com/cve/CVE-2026-70483.htmlhttps://patchthecve.com/cve/CVE-2026-70483.htmlFri, 18 Sep 2026 14:46:24 +0000LOW 3.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort thhttps://patchthecve.com/cve/CVE-2026-70482.htmlhttps://patchthecve.com/cve/CVE-2026-70482.htmlFri, 18 Sep 2026 14:46:15 +0000HIGH 8.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming whihttps://patchthecve.com/cve/CVE-2026-70481.htmlhttps://patchthecve.com/cve/CVE-2026-70481.htmlFri, 18 Sep 2026 14:46:06 +0000MEDIUM 5.4: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is thttps://patchthecve.com/cve/CVE-2026-70480.htmlhttps://patchthecve.com/cve/CVE-2026-70480.htmlFri, 18 Sep 2026 14:45:55 +0000MEDIUM 4.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such a bhttps://patchthecve.com/cve/CVE-2026-70479.htmlhttps://patchthecve.com/cve/CVE-2026-70479.htmlFri, 18 Sep 2026 14:45:45 +0000HIGH 7.7: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEB_LOADER_ENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated u