PT-2026-56882 · Openwebui · Open-Webui

Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-59216

Mitre

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get event call delivered execute:python and execute:tool Socket.IO events to a client-supplied session id after checking only that the session was connected, allowing authenticated users who learned another socket ID through ydoc:document:join to run code interpreter Python or tools in that user session. This issue is fixed in version 0.10.0.

Correção

Missing Authorization

IDOR

Code Injection

Information Disclosure

Enumeração de Fraquezas

CWE-862

CWE-639

CWE-94

CWE-200

Identificadores relacionados

CVE-2026-59216

Produtos afetados

Open-Webui

Referências · 5

• https://github.com/open-webui/open-webui/pull/25763 · Nota
• https://github.com/open-webui/open-webui/commit/386ac958144dbbbf0aa6e268070d72b681a318aa · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59216 · Nota de Segurança
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 · Nota
• https://github.com/open-webui/open-webui/security/advisories/GHSA-74h3-cxq7-vc5q · Nota