PyPI/open-webui CVE-2025-63681: low, EPSS 0.28%
open-webui is Vulnerable to Incorrect Access Control
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.6.33 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-frv8-gffc-37px
- https://nvd.nist.gov/vuln/detail/CVE-2025-63681
- https://github.com/TOAST-Research/pocs/blob/main/openwebui/arbitirary_task_stop/report.md
- https://github.com/open-webui/open-webui
- https://github.com/open-webui/open-webui/blob/46ae3f4f5d7d4d706041bdae4ad2d802e568712b/backend/open_webui/main.py#L1652
CVE-2025-63681 · published · modified · JSON