| Component | Open WebUI |
| Severity | medium (CVSS 5.4) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| Published (NVD) | 2026-07-09 |
| Last modified | 2026-07-10 |
| Affected versions | open_webui = 0.9.6 |
| Fixed in | see the vendor advisory |
| Weakness | CWE-863 |
| CISA KEV | not listed |
NVD description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_knowledge_file_access only checked read access while file write and delete routes later trusted object-derived access through writable model meta.knowledge entries, allowing a user with read-only knowledge file access to upgrade to file write or delete operations. This issue is fixed in version 0.10.0.
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep Open WebUI off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-59212
- https://github.com/open-webui/open-webui/security/advisories/GHSA-2xwm-4h2q-ggfx
- https://github.com/open-webui/open-webui/commit/17df0264929514599dbcb21c6578bcdfa204b04d
- https://github.com/open-webui/open-webui/pull/26032
- https://github.com/open-webui/open-webui/releases/tag/v0.10.0
Read more
Other Open WebUI CVEs
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link UR...
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in...
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only fro...
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to stea...
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base...
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied dir...