PT-2026-60120 · Unknown · Open-Webui

CVE-2026-56400

·

Published

2026-05-11

·

Updated

2026-07-15

CVSS v3.1

9.6

Critical

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions open-webui versions prior to 0.3.14
Description A cross-origin resource sharing (CORS) misconfiguration occurs when allow origins is set to *. This allows authenticated requests from arbitrary origins to the '/api/v1/functions' endpoint. An attacker can execute arbitrary code on the instance by crafting malicious cross-site requests from a controlled website that is visited by an administrator.
Recommendations Update to version 0.3.14 or later. Restrict the use of the '/api/v1/functions' endpoint by ensuring allow origins is not set to *.

Exploit

Fix

Insufficient Session Expiration

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-56400
GHSA-6XCP-7MPR-M7WM

Affected Products

Open-Webui