CVE-2026-45301

8.1 Élevée

Publiée le 16/05/2026 à 00:16 · Modifiée le 17/06/2026 à 12:51 · Modifiée · Source : security-advisories@github.com

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.

Traduire en français

Produits concernés

open-webui
Openwebui open webui

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-284

Références

https://github.com/open-webui/open-webui/security/advisories/GHSA-r8wh-8m7r-fh33 ExploitVendor Advisory
https://github.com/open-webui/open-webui/security/advisories/GHSA-r8wh-8m7r-fh33 ExploitVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories