PT-2026-60120 · Unknown · Open-Webui
CVE-2026-56400
·
Published
2026-05-11
·
Updated
2026-07-15
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
open-webui versions prior to 0.3.14
Description
A cross-origin resource sharing (CORS) misconfiguration occurs when
allow origins is set to *. This allows authenticated requests from arbitrary origins to the '/api/v1/functions' endpoint. An attacker can execute arbitrary code on the instance by crafting malicious cross-site requests from a controlled website that is visited by an administrator.Recommendations
Update to version 0.3.14 or later.
Restrict the use of the '/api/v1/functions' endpoint by ensuring
allow origins is not set to *.Exploit
Fix
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Open-Webui