Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any auth
#cwe-862
共收录 4167 条相关情报。
← 返回所有主题Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
CVE-2026-58438
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot
Private Repository Metadata Remains Accessible After Access Revocation
CVE-2026-58434
Private Repository Metadata Remains Accessible After Access Revocation
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
CVE-2026-58433
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an ...
CVE-2026-58432
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Criti
Cross-repository issue/comment attachment re-linking can expose private attachment content
CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
CVE-2026-58438
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot
Private Repository Metadata Remains Accessible After Access Revocation
CVE-2026-58434
Private Repository Metadata Remains Accessible After Access Revocation
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
CVE-2026-58433
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an ...
CVE-2026-58432
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Criti
Cross-repository issue/comment attachment re-linking can expose private attachment content
CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
CVE-2026-73403
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
CVE-2026-73401
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
CVE-2026-73353
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-73349
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
Subscriber Broken Access Control in Motors <= 1.4.113 versions.
CVE-2026-66693
Subscriber Broken Access Control in Motors <= 1.4.113 versions.
Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.
CVE-2026-66689
Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
CVE-2026-66660
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.