CVSS 3.1
8.0 highCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HCVE-2026-59224
High (8.0) in openwebui open webui. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in open-webui 0.10.0.
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbound identity claim. This issue is fixed in version 0.10.0.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-287, CWE-290
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openwebui:open_webui
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j657-m4c4-24jq | PyPI | open-webui | <0.10.0 | 0.10.0 |
| PYSEC-2026-3600 | PyPI | open-webui | <0.10.0 | 0.10.0 |