CVE-2026-54015

Katalog CVE

CVSS 6.4 · Medium EPSS 0,27%

Kerentanan Improper Access Control pada openwebui open webui. Skor CVSS 3.1 6.4 (Medium) menurut github.com.

Deskripsi (NVD)

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the prompt_id in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that prompt (history_entry.prompt_id == prompt.id). This affects /api/v1/prompts/id/{prompt_id}/history/diff, /api/v1/prompts/id/{prompt_id}/update/version, and /api/v1/prompts/id/{prompt_id}/history/{history_id}. An authenticated user with access to any prompt they control, plus a victim prompt_history.id, can read or delete another user's private prompt history. This vulnerability is fixed in 0.9.6.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

25 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/security/advisories/GHSA-4r4w-2wgp-w7cj exploit · mitigasi · advisory vendor