Storyline
Multiple critical vulnerabilities disclosed in Open WebUI including IDOR, SSRF, and XSS
A series of high-severity security vulnerabilities have been disclosed in Open WebUI, affecting various components such as APIs, rendering views, and access controls.
Published 2026-05-08 19:38 UTCUpdated 2026-05-14 20:28 UTC
Current brief openSource links open
This current storyline is open here with summary, metadata, source links, continuity context, and full evidence. Paid is for compare-over-time, alerts, exports, and workflow.
No card needed for the free brief.
Evidence trail (top sources)
top sources (1 domains)domains are deduped. counts indicate coverage, not truth.1 top source shown
limited source diversity in top sources
Overview
A series of high-severity security vulnerabilities have been disclosed in Open WebUI, affecting various components such as APIs, rendering views, and access controls.
Score total
1.98
Momentum 24h
34
Posts
34
Origins
1
Source types
1
Duplicate ratio
0%
Why now
- Recent advisories reveal multiple critical issues requiring urgent patching.
- Open WebUI's widespread use increases potential impact of these vulnerabilities.
- Attackers may exploit these flaws if not promptly addressed, risking data breaches and service disruption.
Why it matters
- Exploitable IDOR and broken access controls can lead to unauthorized data access and manipulation.
- SSRF and stored XSS vulnerabilities increase risk of remote code execution and data theft.
- Feature gate bypasses and CSRF flaws undermine security controls, threatening system integrity.
Continuity snapshot
- Trend status: insufficient_history.
- Continuity stage: seed.
- Current status: open.
- 34 current source-linked posts are attached to this storyline.
All evidence
All evidence
Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
github_advisories · github.com · 2026-05-14 20:28 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 1Origin domains: 1Duplicates: -
Showing 1 / 0
Top publishers (this list)
- github_advisories (1)
Top origin domains (this list)
- github.com (1)