GHSA-p4fx-23fq-jfg6
High · 7.2CVSS
7.2
EPSS
—
Published
May 14, 2026
CISA due date
—
The record
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | open-webui | 0 | 0.9.5 |
Related vulnerabilities
- CVE-2026-45395 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Same vulnerability
- CVE-2026-45346 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- CVE-2026-45665 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- CVE-2026-44721 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- GHSA-cqp4-qqvg-3787 Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order Also affects open-webui
- GHSA-r29h-37fj-x2w6 Open WebUI Has Stored Cross-Site Scripting in SVG Renderer Also affects open-webui
- GHSA-gf5m-wcrh-7928 open-webui Vulnerable to Stored XSS via Model Description Also affects open-webui
- GHSA-8wvc-869r-xfqf Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF' Also affects open-webui