PyPI/open-webui CVE-2026-54015: medium 6.4, EPSS 0.27%

Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Action: Upgrade open-webui to 0.9.6 or later.

pip install open-webui==0.9.6

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2701
• https://github.com/open-webui/open-webui/security/advisories/GHSA-4r4w-2wgp-w7cj
• https://github.com/open-webui/open-webui
• https://pypi.org/project/open-webui
• https://github.com/advisories/GHSA-4r4w-2wgp-w7cj
• https://nvd.nist.gov/vuln/detail/CVE-2026-54015

CVE-2026-54015 · published 2026-07-13T15:46:19.581493Z · modified 2026-07-13T16:31:52.602071988Z · JSON