修正バージョン
0.8 に影響するCVE
| CVE | タイトル | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|
| CVE-2026-44551 | Open WebUI: LDAP Empty Password Authentication Bypass | 9.1 | — | 2026-05-15 | |
| CVE-2026-59214 | Open WebUI: Stored web worker XSS via Pyodide | 9.0 | — | 2026-07-09 | |
| CVE-2026-59216 | Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id | 9.0 | — | 2026-07-09 | |
| CVE-2026-45672 | Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed | 8.8 | — | 2026-05-15 | |
| CVE-2026-70482 | Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client | 8.8 | — | 2026-08-04 | |
| CVE-2026-45315 | Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions | 8.7 | — | 2026-05-15 | |
| CVE-2026-87995 | Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin | 8.7 | — | 2026-09-09 | |
| CVE-2026-44552 | Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance C... | 8.7 | — | 2026-05-15 | |
| CVE-2026-109286 | Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal | 8.6 | — | 2026-10-13 | |
| CVE-2026-45401 | Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints | 8.5 | — | 2026-05-15 | |
| CVE-2026-56398 | Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI | 8.5 | — | 2026-07-15 | |
| CVE-2026-54008 | Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` | 8.5 | — | 2026-06-23 | |
| CVE-2026-109291 | Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url | 8.5 | — | 2026-10-13 | |
| CVE-2026-45331 | Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature | 8.5 | — | 2026-05-15 | |
| CVE-2026-45400 | Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url` | 8.5 | — | 2026-05-15 | |
| CVE-2026-54010 | Open WebUI: Forged chat-file link allows cross-user file read and deletion | 8.3 | — | 2026-06-23 | |
| CVE-2026-45402 | Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoin... | 8.1 | — | 2026-05-15 | |
| CVE-2026-29070 | Open WebUI has unauthorized deletion of knowledge files | 8.1 | — | 2026-03-27 | |
| CVE-2026-45675 | Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts | 8.1 | — | 2026-05-15 | |
| CVE-2026-44554 | Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite | 8.1 | — | 2026-05-15 | |
| CVE-2026-44553 | Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access | 8.1 | — | 2026-05-15 | |
| CVE-2026-87016 | Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite | 8.1 | — | 2026-09-09 | |
| CVE-2026-59224 | Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id he... | 8.0 | — | 2026-07-09 | |
| CVE-2026-45671 | Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion | 8.0 | — | 2026-05-15 | |
| CVE-2026-45338 | Open WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py) | 7.7 | — | 2026-05-15 | |
| CVE-2026-54017 | Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal | 7.7 | — | 2026-06-18 | |
| CVE-2026-54018 | Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects | 7.7 | — | 2026-06-23 | |
| CVE-2026-34222 | Open WebUI has Broken Access Control in Tool Valves | 7.7 | — | 2026-04-01 | |
| CVE-2026-109292 | Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections | 7.6 | — | 2026-10-13 | |
| CVE-2026-44555 | Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining | 7.6 | — | 2026-05-15 | |
| CVE-2026-54013 | Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI | 7.6 | — | 2026-06-23 | |
| CVE-2026-45398 | Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls | 7.5 | — | 2026-05-15 | |
| CVE-2026-45314 | Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image | 7.4 | — | 2026-05-15 | |
| CVE-2026-44721 | Open WebUI: Stored XSS via Model Description | 7.3 | — | 2026-05-15 | |
| CVE-2026-109572 | Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy | 7.2 | — | 2026-10-13 | |
| CVE-2026-109288 | Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links | 7.2 | — | 2026-10-13 | |
| CVE-2026-45395 | Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation... | 7.2 | — | 2026-05-15 | |
| CVE-2026-45349 | Open WebUI: Broken Access Control for Completions API | 7.1 | — | 2026-05-15 | |
| CVE-2026-45350 | Open WebUI: Chat completion API allows tool restrictions to be bypassed | 7.1 | — | 2026-05-15 | |
| CVE-2026-87999 | Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch | 7.1 | — | 2026-09-09 | |
| CVE-2026-45399 | Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-w... | 7.1 | — | 2026-05-15 | |
| CVE-2026-28788 | Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite | 7.1 | — | 2026-03-27 | |
| CVE-2026-44556 | Open WebUI: responses passthrough endpoint lacks access control authorization | 7.1 | — | 2026-05-15 | |
| CVE-2026-54012 | Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion | 7.1 | — | 2026-06-23 | |
| CVE-2026-54007 | Open WebUI: Cross-origin postMessage confirmation bypass via action:submit | 7.1 | — | 2026-06-23 | |
| CVE-2026-109294 | Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image | 7.1 | — | 2026-10-13 | |
| CVE-2026-87015 | Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication | 6.8 | — | 2026-09-09 | |
| CVE-2026-70487 | Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata | 6.5 | — | 2026-08-04 | |
| CVE-2026-45351 | Open WebUI: Exposure of System Prompt to Regular User [Non-Admin] | 6.5 | — | 2026-05-15 | |
| CVE-2026-54009 | Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field | 6.5 | — | 2026-06-23 | |
| CVE-2026-59715 | Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:d... | 6.5 | — | 2026-07-09 | |
| CVE-2026-70491 | Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints | 6.5 | — | 2026-08-04 | |
| CVE-2026-44560 | Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search | 6.5 | — | 2026-05-15 | |
| CVE-2026-88005 | Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange | 6.5 | — | 2026-09-10 | |
| CVE-2026-44571 | Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission | 6.5 | — | 2026-05-15 | |
| CVE-2026-45339 | Open WebUI: API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restric... | 6.5 | — | 2026-05-15 | |
| CVE-2026-88006 | Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange | 6.5 | — | 2026-09-10 | |
| CVE-2026-44562 | Open WebUI: Model Import Overwrites Any Model Without Ownership Check | 6.5 | — | 2026-05-15 | |
| CVE-2026-45666 | Open WebUI: Indirect Object Reference (IDOR) in user notes | 6.5 | — | 2026-05-15 | |
| CVE-2026-88002 | Open WebUI: Any authenticated user can hang the server via a cyclic chat message history | 6.5 | — | 2026-09-09 | |
| CVE-2026-54019 | Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode | 6.5 | — | 2026-06-23 | |
| CVE-2026-54015 | Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion | 6.4 | — | 2026-06-23 | |
| CVE-2026-54021 | Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path par... | 6.3 | — | 2026-06-23 | |
| CVE-2026-70490 | Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check | 6.3 | — | 2026-08-04 | |
| CVE-2026-59225 | Open WebUI: Arena task endpoints can bypass underlying model access controls | 6.3 | — | 2026-07-09 | |
| CVE-2026-54020 | Open WebUI: DNS Rebinding SSRF Bypass | 6.3 | — | 2026-08-04 | |
| CVE-2026-59222 | Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials | 6.0 | — | 2026-07-09 | |
| CVE-2026-44561 | Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels | 5.4 | — | 2026-05-15 | |
| CVE-2026-45396 | Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data... | 5.4 | — | 2026-05-15 | |
| CVE-2026-45318 | Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify) | 5.4 | — | 2026-05-15 | |
| CVE-2026-44563 | Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show | 5.4 | — | 2026-05-15 | |
| CVE-2026-45365 | Open WebUI: Authenticated users can bypass model access control via exposed query parameter | 5.4 | — | 2026-05-15 | |
| CVE-2026-44558 | Open WebUI: Channel Access Grants Bypass filter_allowed_access_grants | 5.4 | — | 2026-05-15 | |
| CVE-2026-44564 | Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO | 5.4 | — | 2026-05-15 | |
| CVE-2026-70481 | Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages | 5.4 | — | 2026-08-04 | |
| CVE-2026-59227 | Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation p... | 5.4 | — | 2026-07-09 | |
| CVE-2026-70484 | Open WebUI: Users denied the image-generation permission can still generate images via chat completions | 5.4 | — | 2026-08-04 | |
| CVE-2026-54011 | Open WebUI: Stored XSS in Mermaid Markdown Preview | 5.4 | — | 2026-06-23 | |
| CVE-2026-45397 | Open WebUI: Unauthenticated RAG Configuration Disclosure | 5.3 | — | 2026-05-15 | |
| CVE-2026-109289 | Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket | 5.3 | — | 2026-10-13 | |
| CVE-2026-59218 | Open WebUI: Account enumeration via observable login timing discrepancy | 5.3 | — | 2026-07-09 | |
| CVE-2026-109296 | Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes | 5.3 | — | 2026-10-13 | |
| CVE-2026-54022 | Open WebUI: Any authenticated user can read other users' private notes via Socket.IO | 5.3 | — | 2026-06-23 | |
| CVE-2026-109300 | Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds | 5.1 | — | 2026-10-13 | |
| CVE-2026-44550 | Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts | 5.0 | — | 2026-05-15 | |
| CVE-2026-59213 | Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builde... | 5.0 | — | 2026-07-09 | |
| CVE-2026-44568 | Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order | 4.8 | — | 2026-05-15 | |
| CVE-2026-45317 | Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation | 4.6 | — | 2026-05-15 | |
| CVE-2026-29071 | Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories | 4.3 | — | 2026-03-27 | |
| CVE-2026-54006 | Open WebUI: Calendar event re-parenting allows writing events into another user's calendar | 4.3 | — | 2026-06-23 | |
| CVE-2026-87017 | Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backen... | 4.3 | — | 2026-09-09 | |
| CVE-2026-44557 | Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection | 4.3 | — | 2026-05-15 | |
| CVE-2026-45387 | Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leaka... | 4.3 | — | 2026-05-15 | |
| CVE-2026-28786 | Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions` | 4.3 | — | 2026-03-27 | |
| CVE-2025-63681 | open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and c... | 4.3 | — | 2025-12-04 | |
| CVE-2026-45386 | Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint | 4.3 | — | 2026-05-15 | |
| CVE-2026-45385 | Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint | 4.3 | — | 2026-05-15 | |
| CVE-2026-54014 | Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui | 4.3 | — | 2026-06-23 | |
| CVE-2026-59223 | Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary mat... | 4.3 | — | 2026-07-09 | |
| CVE-2026-44559 | Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels | 4.3 | — | 2026-05-15 | |
| CVE-2026-59217 | Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can... | 4.3 | — | 2026-07-09 | |
| CVE-2026-54016 | Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration | 4.3 | — | 2026-06-23 | |
| CVE-2026-70480 | Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering | 4.1 | — | 2026-08-04 | |
| CVE-2026-45316 | Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Acc... | 3.5 | — | 2026-05-15 | |
| CVE-2026-59215 | Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding | 3.1 | — | 2026-07-09 | |
| CVE-2026-109285 | Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata | 2.3 | — | 2026-10-13 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。