https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-88006.htmlhttps://patchthecve.com/cve/CVE-2026-88006.htmlFri, 18 Sep 2026 14:43:56 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose prohttps://patchthecve.com/cve/CVE-2026-88005.htmlhttps://patchthecve.com/cve/CVE-2026-88005.htmlFri, 18 Sep 2026 14:44:04 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account https://patchthecve.com/cve/CVE-2026-88002.htmlhttps://patchthecve.com/cve/CVE-2026-88002.htmlMon, 14 Sep 2026 19:56:27 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id fielhttps://patchthecve.com/cve/CVE-2026-88001.htmlhttps://patchthecve.com/cve/CVE-2026-88001.htmlMon, 14 Sep 2026 19:56:01 +0000MEDIUM 5.0: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled. An authenticated usehttps://patchthecve.com/cve/CVE-2026-88000.htmlhttps://patchthecve.com/cve/CVE-2026-88000.htmlMon, 14 Sep 2026 17:48:49 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-history deletion helper in backend/open_webui/models/chats.py to follow childrenIds without recording visited message identifihttps://patchthecve.com/cve/CVE-2026-87999.htmlhttps://patchthecve.com/cve/CVE-2026-87999.htmlWed, 16 Sep 2026 15:13:49 +0000HIGH 7.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof thathttps://patchthecve.com/cve/CVE-2026-87998.htmlhttps://patchthecve.com/cve/CVE-2026-87998.htmlWed, 16 Sep 2026 15:14:19 +0000HIGH 7.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection https://patchthecve.com/cve/CVE-2026-87997.htmlhttps://patchthecve.com/cve/CVE-2026-87997.htmlWed, 16 Sep 2026 15:14:39 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access checkhttps://patchthecve.com/cve/CVE-2026-87996.htmlhttps://patchthecve.com/cve/CVE-2026-87996.htmlWed, 16 Sep 2026 15:14:48 +0000HIGH 7.7: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and asynhttps://patchthecve.com/cve/CVE-2026-87995.htmlhttps://patchthecve.com/cve/CVE-2026-87995.htmlWed, 16 Sep 2026 15:14:57 +0000HIGH 8.7: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy servehttps://patchthecve.com/cve/CVE-2026-87994.htmlhttps://patchthecve.com/cve/CVE-2026-87994.htmlWed, 16 Sep 2026 15:15:32 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id but did not verify that the calling user auhttps://patchthecve.com/cve/CVE-2026-87017.htmlhttps://patchthecve.com/cve/CVE-2026-87017.htmlWed, 16 Sep 2026 15:23:05 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filterhttps://patchthecve.com/cve/CVE-2026-87016.htmlhttps://patchthecve.com/cve/CVE-2026-87016.htmlTue, 15 Sep 2026 15:29:13 +0000HIGH 8.1: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth suhttps://patchthecve.com/cve/CVE-2026-87015.htmlhttps://patchthecve.com/cve/CVE-2026-87015.htmlTue, 15 Sep 2026 15:54:14 +0000MEDIUM 6.8: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached anhttps://patchthecve.com/cve/CVE-2026-87014.htmlhttps://patchthecve.com/cve/CVE-2026-87014.htmlTue, 15 Sep 2026 15:56:08 +0000MEDIUM 6.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by bachttps://patchthecve.com/cve/CVE-2026-87013.htmlhttps://patchthecve.com/cve/CVE-2026-87013.htmlTue, 15 Sep 2026 16:09:34 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/{id} and POST /ahttps://patchthecve.com/cve/CVE-2026-87012.htmlhttps://patchthecve.com/cve/CVE-2026-87012.htmlTue, 15 Sep 2026 16:17:55 +0000MEDIUM 4.3: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar event meta.alert_minutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An https://patchthecve.com/cve/CVE-2026-87011.htmlhttps://patchthecve.com/cve/CVE-2026-87011.htmlTue, 15 Sep 2026 16:26:18 +0000HIGH 7.5: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout tok