Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats meta.knowledge entries of type file as an authorization source in two places: the built-in view_file tool reads the file's extracted text, and has_access_to_file()'s model branch authorizes the file content and file delete endpoints. A malicious model owner can therefore attach another user's file ID to their model metadata and read or delete that private file. This vulnerability is fixed in 0.9.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Yayy 5 CVE in openwebui !!! 🔥🔥🔥 - CVE-2026-54013 (openwebui 141k⭐️) - CVE-2026-54019 (openwebui 141k⭐️) - CVE-2026-54010 (openwebui 141k⭐️) - CVE-2026-54012 (openwebui 141k⭐️) - CVE-2026-54015 (openwebui 141k⭐️)
Post summary
The post announces five CVE identifiers impacting openwebui but offers no additional technical, exploit, or mitigation information.
CVE-2026-54012 Unauthorized File Access and Deletion in Open WebUI Before 0.9.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54012 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
An alert announces CVE‑2026‑54012, which allows unauthorized file access and deletion in Open WebUI versions earlier than 0.9.6.
🚨High - Open WebUI: Stored XSS + Forged meta.knowledge Cross-User File Access (CVE-2026-54011, CVE-2026-54012) Two high-severity flaws were disclosed in Open WebUI, the popular self-hosted interface for running local and remote LLMs. The first (CVE-2026-54011) is a stored XSS: the Markdown file preview renders Mermaid diagrams with securityLevel: 'loose' and injects the generated SVG into the DOM via innerHTML, so a malicious .md file with a crafted Mermaid block - e.g. a click directive pointing to a javascript: URI - runs arbitrary JavaScript under the app origin when a low-privileged user opens the file and clicks. The second (CVE-2026-54012) is an access-control bypass: Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge file entries without checking ownership, then trusts those entries as authorization in the built-in view_file tool and has_access_to_file(). An attacker with workspace.models permission and a victim's file ID can read the file's extracted text, pull its content via GET /api/v1/files/{id}/content, and delete it via DELETE /api/v1/files/{id} - with no user interaction. 👉Both affect Open WebUI <= 0.9.5; upgrade to 0.9.6.
Post summary
The post announces two high‑severity CVEs (CVE‑2026‑54011 and CVE‑2026‑54012) affecting Open WebUI, provides technical details of a stored XSS and an access‑control bypass, and advises upgrading to version 0.9.6.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openwebui | open_webui | - | - | - |