Mosstrow

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.6.27 **Description** Authenticated users can bypass server-side request forgery (SSRF) protections—a flaw where a server is tricked into making requests to an unintended location. By manipulating URL parameters with location redirect headers, attackers can access internal services and potentially execute commands using instance secrets via the '/api/v1/retrieval/process/web' endpoint. **Recommendations** Update to version 0.6.27 or later. Restrict access to the '/api/v1/retrieval/process/web' endpoint to minimize the risk of exploitation.