CVE Feed

    Dashboard / CVE / CVE-2026-109289

    CVE-2026-109289

    Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.

    Published:Oct 12, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00214
    CVSS Score:6.3

    Affected Products

    Vendor
    Open-webui
    Product
    Open-webui
    Vendor
    Openwebui
    Product
    Open Webui

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-109297 (CVSS 7.1) — Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule v…
    CVE-2026-109291 (CVSS 8.5) — Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated u…
    CVE-2026-109290 (CVSS 8.4) — Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelt…
    CVE-2026-109287 (CVSS 5.3) — Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does …
    CVE-2026-109285 (CVSS 2.3) — Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file th…
    CVE-2026-109284 (CVSS 5.3) — Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler…
    CVE-2026-109283 (CVSS 5.3) — Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, wh…
    CVE-2026-88006 (CVSS 6.5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1,…
    CVE-2026-88005 (CVSS 6.5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, …
    CVE-2026-88002 (CVSS 6.5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1,…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High