CVE Feed

    Dashboard / CVE / CVE-2026-54010

    CVE-2026-54010

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach arbitrary file_id values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, has_access_to_file() treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file. This vulnerability is fixed in 0.9.6.

    Published:Jun 23, 2026
    Last Modified:Jun 23, 2026
    EPS:Jun 23, 2026
    EPSS Score:
    CVSS Score:8.3

    Affected Products

    Vendor
    Open-webui
    Product
    Open-webui

    Exploits

    https://github.com/open-webui/open-webui/security/advisories/GHSA-vrhc-3fr6-pc3chttps://github.com/open-webui/open-webui/security/advisories/GHSA-vrhc-3fr6-pc3c

    Related CVEs

    CVE-2026-88006 (CVSS 6.5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1,…
    CVE-2026-88005 (CVSS 6.5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, …
    CVE-2026-88002 (CVSS 6.5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1,…
    CVE-2026-88001 (CVSS 5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1,…
    CVE-2026-88000 (CVSS 6.5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1…
    CVE-2026-87999 (CVSS 7.1) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /a…
    CVE-2026-87998 (CVSS 7.1) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1…
    CVE-2026-87997 (CVSS 4.3) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1…
    CVE-2026-87996 (CVSS 7.7) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1,…
    CVE-2026-87995 (CVSS 8.7) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High