Corregido en
CVE que afectan a 0.9
| CVE | Título | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|
| CVE-2026-59214 | Open WebUI: Stored web worker XSS via Pyodide | 9.0 | — | 2026-07-09 | |
| CVE-2026-59216 | Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id | 9.0 | — | 2026-07-09 | |
| CVE-2026-70482 | Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client | 8.8 | — | 2026-08-04 | |
| CVE-2026-45315 | Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions | 8.7 | — | 2026-05-15 | |
| CVE-2026-87995 | Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin | 8.7 | — | 2026-09-09 | |
| CVE-2026-109286 | Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal | 8.6 | — | 2026-10-13 | |
| CVE-2026-45401 | Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints | 8.5 | — | 2026-05-15 | |
| CVE-2026-56398 | Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI | 8.5 | — | 2026-07-15 | |
| CVE-2026-54008 | Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` | 8.5 | — | 2026-06-23 | |
| CVE-2026-109291 | Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url | 8.5 | — | 2026-10-13 | |
| CVE-2026-45400 | Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url` | 8.5 | — | 2026-05-15 | |
| CVE-2026-54010 | Open WebUI: Forged chat-file link allows cross-user file read and deletion | 8.3 | — | 2026-06-23 | |
| CVE-2026-45402 | Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoin... | 8.1 | — | 2026-05-15 | |
| CVE-2026-87016 | Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite | 8.1 | — | 2026-09-09 | |
| CVE-2026-59224 | Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id he... | 8.0 | — | 2026-07-09 | |
| CVE-2026-70479 | Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader | 7.7 | — | 2026-08-04 | |
| CVE-2026-87996 | Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader | 7.7 | — | 2026-09-09 | |
| CVE-2026-54017 | Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal | 7.7 | — | 2026-06-18 | |
| CVE-2026-59221 | open-webui terminal proxy path traversal guard bypass via 9x encoded traversal | 7.7 | — | 2026-07-09 | |
| CVE-2026-54018 | Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects | 7.7 | — | 2026-06-23 | |
| CVE-2026-109292 | Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections | 7.6 | — | 2026-10-13 | |
| CVE-2026-54013 | Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI | 7.6 | — | 2026-06-23 | |
| CVE-2026-87011 | Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout | 7.5 | — | 2026-09-09 | |
| CVE-2026-45398 | Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls | 7.5 | — | 2026-05-15 | |
| CVE-2026-45314 | Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image | 7.4 | — | 2026-05-15 | |
| CVE-2026-109572 | Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy | 7.2 | — | 2026-10-13 | |
| CVE-2026-109288 | Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links | 7.2 | — | 2026-10-13 | |
| CVE-2026-45395 | Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation... | 7.2 | — | 2026-05-15 | |
| CVE-2026-70485 | Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs | 7.1 | — | 2026-08-04 | |
| CVE-2026-59714 | Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids) | 7.1 | — | 2026-08-14 | |
| CVE-2026-87999 | Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch | 7.1 | — | 2026-09-09 | |
| CVE-2026-54012 | Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion | 7.1 | — | 2026-06-23 | |
| CVE-2026-109299 | Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation | 7.1 | — | 2026-10-13 | |
| CVE-2026-54007 | Open WebUI: Cross-origin postMessage confirmation bypass via action:submit | 7.1 | — | 2026-06-23 | |
| CVE-2026-109294 | Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image | 7.1 | — | 2026-10-13 | |
| CVE-2026-59219 | Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout | 7.1 | — | 2026-07-09 | |
| CVE-2026-87015 | Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication | 6.8 | — | 2026-09-09 | |
| CVE-2026-70487 | Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata | 6.5 | — | 2026-08-04 | |
| CVE-2026-70493 | Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrop... | 6.5 | — | 2026-08-04 | |
| CVE-2026-59220 | Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config | 6.5 | — | 2026-07-09 | |
| CVE-2026-54009 | Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field | 6.5 | — | 2026-06-23 | |
| CVE-2026-59715 | Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:d... | 6.5 | — | 2026-07-09 | |
| CVE-2026-70491 | Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints | 6.5 | — | 2026-08-04 | |
| CVE-2026-70489 | Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing | 6.5 | — | 2026-08-04 | |
| CVE-2026-88006 | Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange | 6.5 | — | 2026-09-10 | |
| CVE-2026-88002 | Open WebUI: Any authenticated user can hang the server via a cyclic chat message history | 6.5 | — | 2026-09-09 | |
| CVE-2026-54019 | Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode | 6.5 | — | 2026-06-23 | |
| CVE-2026-87014 | Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes | 6.5 | — | 2026-09-09 | |
| CVE-2026-54015 | Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion | 6.4 | — | 2026-06-23 | |
| CVE-2026-54021 | Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path par... | 6.3 | — | 2026-06-23 | |
| CVE-2026-70490 | Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check | 6.3 | — | 2026-08-04 | |
| CVE-2026-59225 | Open WebUI: Arena task endpoints can bypass underlying model access controls | 6.3 | — | 2026-07-09 | |
| CVE-2026-54020 | Open WebUI: DNS Rebinding SSRF Bypass | 6.3 | — | 2026-08-04 | |
| CVE-2026-59222 | Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials | 6.0 | — | 2026-07-09 | |
| CVE-2026-45396 | Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data... | 5.4 | — | 2026-05-15 | |
| CVE-2026-45318 | Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify) | 5.4 | — | 2026-05-15 | |
| CVE-2026-70481 | Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages | 5.4 | — | 2026-08-04 | |
| CVE-2026-59227 | Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation p... | 5.4 | — | 2026-07-09 | |
| CVE-2026-70484 | Open WebUI: Users denied the image-generation permission can still generate images via chat completions | 5.4 | — | 2026-08-04 | |
| CVE-2026-70486 | Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin | 5.4 | — | 2026-08-04 | |
| CVE-2026-54011 | Open WebUI: Stored XSS in Mermaid Markdown Preview | 5.4 | — | 2026-06-23 | |
| CVE-2026-59212 | Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete | 5.4 | — | 2026-07-09 | |
| CVE-2026-45397 | Open WebUI: Unauthenticated RAG Configuration Disclosure | 5.3 | — | 2026-05-15 | |
| CVE-2026-109289 | Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket | 5.3 | — | 2026-10-13 | |
| CVE-2026-109287 | Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID | 5.3 | — | 2026-10-13 | |
| CVE-2026-59218 | Open WebUI: Account enumeration via observable login timing discrepancy | 5.3 | — | 2026-07-09 | |
| CVE-2026-109296 | Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes | 5.3 | — | 2026-10-13 | |
| CVE-2026-109300 | Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds | 5.1 | — | 2026-10-13 | |
| CVE-2026-88001 | Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets | 5.0 | — | 2026-09-09 | |
| CVE-2026-59213 | Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builde... | 5.0 | — | 2026-07-09 | |
| CVE-2026-45317 | Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation | 4.6 | — | 2026-05-15 | |
| CVE-2026-70483 | Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint | 4.3 | — | 2026-08-04 | |
| CVE-2026-87994 | Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint | 4.3 | — | 2026-09-09 | |
| CVE-2026-54006 | Open WebUI: Calendar event re-parenting allows writing events into another user's calendar | 4.3 | — | 2026-06-23 | |
| CVE-2026-87017 | Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backen... | 4.3 | — | 2026-09-09 | |
| CVE-2026-87012 | Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value | 4.3 | — | 2026-09-09 | |
| CVE-2026-45387 | Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leaka... | 4.3 | — | 2026-05-15 | |
| CVE-2026-70488 | Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup | 4.3 | — | 2026-08-04 | |
| CVE-2026-45386 | Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint | 4.3 | — | 2026-05-15 | |
| CVE-2026-59226 | Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation | 4.3 | — | 2026-07-09 | |
| CVE-2026-45385 | Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint | 4.3 | — | 2026-05-15 | |
| CVE-2026-54014 | Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui | 4.3 | — | 2026-06-23 | |
| CVE-2026-59223 | Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary mat... | 4.3 | — | 2026-07-09 | |
| CVE-2026-59217 | Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can... | 4.3 | — | 2026-07-09 | |
| CVE-2026-54016 | Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration | 4.3 | — | 2026-06-23 | |
| CVE-2026-70480 | Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering | 4.1 | — | 2026-08-04 | |
| CVE-2026-45316 | Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Acc... | 3.5 | — | 2026-05-15 | |
| CVE-2026-59215 | Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding | 3.1 | — | 2026-07-09 | |
| CVE-2026-109285 | Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata | 2.3 | — | 2026-10-13 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).