CVE-2026-109286
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in…
- Risk score
- 54/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.11.4 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
- Remotely exploitable without logging in
References
Original description
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.
Last activity 12 Oct 2026. Patch Forecast updates every hour.