CVE-2026-54015— Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
Quick assessment
Affected
open-webui open-webui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Open WebUI是Open WebUI团队开源的一个可扩展、功能丰富、用户友好的自托管 WebUI。 Open WebUI 0.9.6之前版本存在安全漏洞，该漏洞源于提示版本历史端点未验证历史记录是否属于指定提示，可能导致经过身份验证的用户读取或删除其他用户的私有提示历史。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| open-webui | open-webui | < 0.9.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54015
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
Source: CVE Program / CVE List V5
Vulnerability Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the prompt_id in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that prompt (history_entry.prompt_id == prompt.id). This affects /api/v1/prompts/id/{prompt_id}/history/diff, /api/v1/prompts/id/{prompt_id}/update/version, and /api/v1/prompts/id/{prompt_id}/history/{history_id}. An authenticated user with access to any prompt they control, plus a victim prompt_history.id, can read or delete another user's private prompt history. This vulnerability is fixed in 0.9.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Open WebUI 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open WebUI是Open WebUI团队开源的一个可扩展、功能丰富、用户友好的自托管 WebUI。 Open WebUI 0.9.6之前版本存在安全漏洞，该漏洞源于提示版本历史端点未验证历史记录是否属于指定提示，可能导致经过身份验证的用户读取或删除其他用户的私有提示历史。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-webui | open-webui | < 0.9.6 | - |
|
II. Public POCs for CVE-2026-54015
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54015
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54015 (1)
Same Patch Batch · open-webui · 2026-06-23 · 15 CVEs total
| CVE-2026-54011 | 8.7 HIGH | Open WebUI: Stored XSS in Mermaid Markdown Preview |
| CVE-2026-54008 | 8.5 HIGH | Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` |
| CVE-2026-54010 | 8.3 HIGH | Open WebUI: Forged chat-file link allows cross-user file read and deletion |
| CVE-2026-54018 | 7.7 HIGH | Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects |
| CVE-2026-54013 | 7.6 HIGH | Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI |
| CVE-2026-54012 | 7.1 HIGH | Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion |
| CVE-2026-54009 | 6.5 MEDIUM | Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field |
| CVE-2026-54019 | 6.5 MEDIUM | Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode |
| CVE-2026-54021 | 6.3 MEDIUM | Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguar |
| CVE-2026-54022 | 5.3 MEDIUM | Open WebUI: Any authenticated user can read other users' private notes via Socket.IO |
| CVE-2026-54016 | 4.3 MEDIUM | Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base F |
| CVE-2026-54006 | 4.3 MEDIUM | Open WebUI: Calendar event re-parenting allows writing events into another user's calendar |
| CVE-2026-54014 | 4.3 MEDIUM | Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui |
| CVE-2026-54007 | Open WebUI: Cross-origin postMessage confirmation bypass via action:submit |
IV. Related Vulnerabilities
Same product: open-webui
-
CVE-2026-88006
Open WebUI: Users denied by the OAuth role policy can still -
CVE-2026-88005
Open WebUI: Users denied by the OAuth domain allowlist or ro -
CVE-2026-88002
Open WebUI: Any authenticated user can hang the server via a -
CVE-2026-88001
Open WebUI: Server-side fetches reach blocked and internal h -
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via m
Same vendor: open-webui
-
CVE-2026-88006
Open WebUI: Users denied by the OAuth role policy can still -
CVE-2026-88005
Open WebUI: Users denied by the OAuth domain allowlist or ro -
CVE-2026-88002
Open WebUI: Any authenticated user can hang the server via a -
CVE-2026-88001
Open WebUI: Server-side fetches reach blocked and internal h -
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via m
Same weakness: CWE-284
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-63045
Apache HTTP Server: mod_proxy_ftp PASV address handling -
CVE-2026-76142
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the -
CVE-2026-103534
David-Crty databasement Snapshot Model snapshots SnapshotPol -
CVE-2026-102132
Kiteworks Core Privilege Escalation through Improper Access
V. Comments for CVE-2026-54015
No comments yet