cve.bz

CVE-2026-59215

3.1 lowEPSS 0.3%

Low (3.1) in openwebui open webui. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in open-webui 0.10.0.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread parent and reply handling did not bind parent_id to the channel in the URL, allowing an authenticated user to reference a message from another private or DM channel and disclose thread context across channels. This issue is fixed in version 0.10.0.

Severity

CVSS 3.1

3.1 low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-11-01)
CWE
CWE-639
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-73x5-h92w-xc2jPyPIopen-webui<0.10.00.10.0
PYSEC-2026-3591PyPIopen-webui<0.10.00.10.0

References

Check your stackJSON