CVE-2026-59222: open-webui
Vulnerability summary
CVE-2026-59222 is a medium (CVSS 6.5) vulnerability in open-webui. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 09-07-2026PublishedVulnerability first disclosed.
- 09-07-2026Last modifiedVulnerability information updated.
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · PypiEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
+0.14 pp
From 0.32% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOpen Webui
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Open-webui1 product
- open-webui≥ 0.7.0, < 0.10.0
Openwebui1 product
- open_webui≥ 0.7.0, < 0.10.0
PyPI1 product
- open-webui≥ 0.7.0, < 0.10.0
3 vendors · 3 products
References
7 links- github.com/open-webui/open-webui/security/advisories/GHSA-gh7p-78x6-jw6mX Refsource CONFIRMWEBExploitVendor Advisory
- github.com/open-webui/open-webui/commit/fbcdcf146b99b5002705060a8243eee769108f9eX Refsource MISCWEBPatch
- pypi.org/project/open-webuiPACKAGE