CVE Feed

    Dashboard / CVE / CVE-2026-87016

    CVE-2026-87016

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.

    Published:Sep 9, 2026
    Last Modified:Sep 15, 2026
    EPS:Sep 9, 2026
    EPSS Score:0.00334
    CVSS Score:8.1

    Affected Products

    Vendor
    Open-webui
    Product
    Open-webui
    Vendor
    Openwebui
    Product
    Open Webui

    Exploits

    https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7

    Related CVEs

    CVE-2026-109297 (CVSS 7.1) — Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule v…
    CVE-2026-109291 (CVSS 8.5) — Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated u…
    CVE-2026-109290 (CVSS 8.4) — Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelt…
    CVE-2026-109289 (CVSS 5.3) — Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated u…
    CVE-2026-109287 (CVSS 5.3) — Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does …
    CVE-2026-109285 (CVSS 2.3) — Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file th…
    CVE-2026-109284 (CVSS 5.3) — Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler…
    CVE-2026-109283 (CVSS 5.3) — Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, wh…
    CVE-2026-88006 (CVSS 6.5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1,…
    CVE-2026-88005 (CVSS 6.5) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High