Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

CVE-2026-44563

# Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show ## Affected Componen

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI's Model Import Overwrites Any Model Without Ownership Check

CVE-2026-44562

# Model Import Overwrites Any Model Without Ownership Check ## Affected Component Model import endpoint: - `backend/op

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

CVE-2026-44559

# Missing Access Check on Channel Members Endpoint for Standard Channels ## Affected Component Channel members listing

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

CVE-2026-44557

# Global Knowledge Base Enumeration via knowledge-bases Meta-Collection ## Affected Component Retrieval collection acc

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

CVE-2026-44554

# Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite ## Affected Component Retrieval w

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI's responses passthrough endpoint lacks access control authorization

CVE-2026-44556

## Summary The /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly t

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

CVE-2026-44555

# Base Model Routing Bypasses Access Control via Model Chaining ## Affected Component Model chaining via `base_model_i

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

CVE-2026-44550

# Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts ## Affected Component Fo

历史摘要 · 未重新核验 · GitHub Advisory

SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote attackers to...

CVE-2026-44125

SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the

历史摘要 · 未重新核验 · NVD

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The...

CVE-2026-39816

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Requi

历史摘要 · 未重新核验 · NVD

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend lacks authorization controls, leaving security entirely t...

CVE-2026-8077

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend

历史摘要 · 未重新核验 · NVD

Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing...

CVE-2026-41498

Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit

历史摘要 · 未重新核验 · NVD

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

## Summary `PUT /api/echo/like/:id` at `internal/router/echo.go:12` is registered on `PublicRouterGroup` with no authen

历史摘要 · 未重新核验 · GitHub Advisory

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

### Summary **No authentication** is required to invoke **`PUT /api/echo/like/:id`**. The handler is registered on the

历史摘要 · 未重新核验 · GitHub Advisory

Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Poster: from n/a thro...

CVE-2026-27416

Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Secur

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal Elemento...

CVE-2026-25436

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Co

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorrectly Configured Access Control Security Levels. This is...

CVE-2025-66105

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorr

历史摘要 · 未重新核验 · NVD

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_schedule() f...

CVE-2026-6214

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0.

历史摘要 · 未重新核验 · NVD

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (delete, retire, reins...

CVE-2026-41658

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces author

历史摘要 · 未重新核验 · NVD

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in...

CVE-2026-4807

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and inclu

历史摘要 · 未重新核验 · GitHub Advisory