PyPI/open-webui CVE-2025-63681: medium 4.3, EPSS 0.28%
open-webui is Vulnerable to Incorrect Access Control
Action: Upgrade open-webui to 0.9.0 or later.
pip install open-webui==0.9.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.0 | - |
Fixed versions
| 0.9.0 |
Sources
- osv: PYSEC-2026-1732
- nvd: CVE-2025-63681
- https://github.com/TOAST-Research/pocs/blob/main/openwebui/arbitirary_task_stop/report.md
- https://github.com/open-webui/open-webui
- https://github.com/open-webui/open-webui/blob/46ae3f4f5d7d4d706041bdae4ad2d802e568712b/backend/open_webui/main.py#L1652
- https://pypi.org/project/open-webui
- https://github.com/advisories/GHSA-frv8-gffc-37px
- https://github.com/open-webui/open-webui/commit/e7ff4768f8ffe1924b4576381c9e45e8a64350e4
CVE-2025-63681 · published · modified · JSON