Количество 2
Количество 2
CVE-2026-59222
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0.
GHSA-gh7p-78x6-jw6m
Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-59222 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0. | CVSS3: 6.5 | 0% Низкий | около 2 месяцев назад |
| GHSA-gh7p-78x6-jw6m Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials | 0% Низкий | около 1 месяца назад |
Уязвимостей на страницу