{"action":"Upgrade open-webui to 0.9.0 or later.","affected":[{"fixed":"0.9.0","introduced":"0"}],"component":"open-webui","cve_ids":["CVE-2025-63681"],"ecosystem":"PyPI","epss":0.00283,"exploited":false,"fixed_versions":["0.9.0"],"ghsa_id":"GHSA-frv8-gffc-37px","id":"tcs_01M5KGVBW55SKHHFV874W6TM8V","modified_at":"2026-07-23T11:45:10.953792544Z","published_at":"2026-07-07T16:03:12.102402Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1732","https://nvd.nist.gov/vuln/detail/CVE-2025-63681","https://github.com/TOAST-Research/pocs/blob/main/openwebui/arbitirary_task_stop/report.md","https://github.com/open-webui/open-webui","https://github.com/open-webui/open-webui/blob/46ae3f4f5d7d4d706041bdae4ad2d802e568712b/backend/open_webui/main.py#L1652","https://pypi.org/project/open-webui","https://github.com/advisories/GHSA-frv8-gffc-37px","https://github.com/open-webui/open-webui/commit/e7ff4768f8ffe1924b4576381c9e45e8a64350e4"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-1732","url":"https://osv.dev/vulnerability/PYSEC-2026-1732"},{"source":"nvd","source_id":"CVE-2025-63681","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-63681"}],"summary":"open-webui is Vulnerable to Incorrect Access Control"}