GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

GHSA-94p4-4cq8-9g67 HIGH 3 days ago

## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped `R...

pypi

No PRs yet

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

GHSA-hfhx-w8p8-4hc7 MODERATE 3 days ago

# Budibase: SSRF via bare fetch() in uploadUrl during AI table generation ## Summary The `uploadUrl()` function in `packages/server/src/utilities...

npm

No PRs yet

Budibase: SSRF via DNS rebinding in the REST datasource integration

GHSA-v42f-v8xc-j435 HIGH 3 days ago

### Summary Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the target hostname, checking e...

npm

No PRs yet

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

GHSA-pmpg-2mxq-6xwr HIGH 3 days ago

## Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builde...

npm

No PRs yet

Budibase: Account Enumeration via Login Lockout Response Differential

GHSA-cr7p-cr3q-h5cm MODERATE 3 days ago

## Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate v...

npm

No PRs yet

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

GHSA-pvcr-8mvp-w8qr HIGH 3 days ago

### Summary The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **external chat identity** (Slac...

npm

No PRs yet

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

GHSA-2xgg-r2wc-c5r2 HIGH 3 days ago

### Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection), reported in the same ori...

npm

No PRs yet

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

GHSA-qw6m-8fw2-2v64 HIGH 3 days ago

## Summary Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injection through user-supplied qu...

npm

No PRs yet

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

GHSA-gh4h-34gr-87r7 MODERATE 3 days ago

## Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in...

npm

No PRs yet

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

GHSA-hr66-5mqr-8mpx HIGH 3 days ago

#### Summary The Budibase Worker service exposes a public, unauthenticated API endpoint (`GET /api/global/users/tenant/:id`) that returns sensitive...

npm

No PRs yet

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

GHSA-mqhr-6j6h-74p5 CRITICAL 3 days ago

## Summary Budibase attaches a REST datasource's stored credentials (Bearer/Basic tokens and static headers) to an outgoing request before it decid...

npm

No PRs yet

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

GHSA-c3jm-gv5r-9wcp CVE-2026-62323 MODERATE 3 days ago

## Summary Cloudreve WOPI access tokens are generated as `<session-id>.<random-secret>`, but the WOPI middleware validates only the session id pre...

go

No PRs yet

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

GHSA-hp6v-6jw7-gv2f CRITICAL 3 days ago

### Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account **by email address alone**, without ever check...

npm

No PRs yet

Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

GHSA-xg5g-26x8-cvf4 HIGH 3 days ago

## Impact A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets by using DNS rebinding aga...

npm

No PRs yet

Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs

GHSA-xcx6-4f2g-hhgx HIGH 3 days ago

## Impact In Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any BASIC app user to obtain S...

npm

No PRs yet

Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

GHSA-ppr4-5f46-j9c6 HIGH 3 days ago

## Summary When creating a MongoDB datasource, Budibase passes the `tlsCertificateKeyFile` and `tlsCAFile` fields straight to the MongoDB driver as...

npm

No PRs yet

Budibase: SQL Injection via `multipleStatements: true`

GHSA-q6x4-v3qx-85qw CRITICAL 3 days ago

## Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary ...

npm

No PRs yet

Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

GHSA-c8vc-7pv3-g98p HIGH 3 days ago

## Summary `POST /api/v2/email` on the account portal (`account.budibase.app`) starts an email-change workflow using a client-supplied `accountId`...

npm

No PRs yet

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

GHSA-fcrw-f7gg-6g9f MODERATE 3 days ago

## Summary The `/api/users/metadata` and `/api/users/metadata/:id` endpoints in `@budibase/server` return full global user profiles to any user wi...

npm

No PRs yet

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

GHSA-4qcj-m5wp-jmf4 MODERATE 3 days ago

## Summary The `GET /api/global/groups` endpoint on the worker service has no role-based authorization middleware. Any authenticated user (includi...

npm

No PRs yet

Budibase: Privilege escalation via public role assignment API missing app-level authorization

GHSA-j9fc-w3mr-x6mv HIGH 3 days ago

### Summary Budibase `3.39.19` (commit `03fbabae4`) is affected by a privilege-escalation / missing-authorization flaw in the public role-assignme...

npm

No PRs yet

react-server-dom: Denial of Service in Server Functions

GHSA-wx67-qw84-cm4g CVE-2026-44907 HIGH 3 days ago

### Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this coul...

npm

No PRs yet

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

GHSA-wg5r-wc3x-39vc CVE-2026-62379 CRITICAL 3 days ago

## Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (`/authservice`, PLL) accept...

maven

No PRs yet

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

GHSA-vqxv-6xrh-49cp CVE-2026-62280 MODERATE 3 days ago

### Description The OAuth2/OIDC consent page rendered for `display=wap` authorize requests reflected several request-derived values into the HTML r...

maven

No PRs yet

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

GHSA-gf8h-gq53-288j CVE-2026-62263 CRITICAL 3 days ago

### Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an `ObjectInputFilter` meant to allow only `Authenticator...

maven

No PRs yet

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

GHSA-frvj-c5qp-xj4w CVE-2026-59221 HIGH 3 days ago

AI assistance was used to help inspect the code and prepare this report. ## Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and c...

pypi

No PRs yet

Open WebUI: Arena task endpoints can bypass underlying model access controls

GHSA-m3qf-58wf-w979 CVE-2026-59225 MODERATE 3 days ago

## Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoin...

pypi

No PRs yet

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

GHSA-2xwm-4h2q-ggfx CVE-2026-59212 MODERATE 3 days ago

## Summary Current `main` and `v0.9.6` still allow an authenticated user to turn read-only access to another user's file into write/delete access ...

pypi

No PRs yet

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

GHSA-j657-m4c4-24jq CVE-2026-59224 HIGH 3 days ago

## Summary The terminal proxy in `backend/open_webui/routers/terminals.py` forwards the Open WebUI user's identity to the upstream terminal server...

pypi

No PRs yet

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

GHSA-qg3f-8x3j-ggf2 CVE-2026-59223 MODERATE 3 days ago

## Summary The administrator-configured `WEB_FETCH_FILTER_LIST` (the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-t...

pypi

No PRs yet

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

GHSA-g35j-m5xg-vh3q CVE-2026-57497 MODERATE 3 days ago

## Summary An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. T...

go

No PRs yet

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

GHSA-hq88-5x99-x3gf CVE-2026-55502 HIGH 3 days ago

## Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to `Admin.Rea...

go

No PRs yet

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

GHSA-w8x7-h2px-xmq8 CVE-2026-55499 MODERATE 3 days ago

## Summary When an authenticated recipient of a **single-file** share opens the file event stream (`GET /api/v4/file/events?uri=<share-root>`), C...

go

No PRs yet

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

GHSA-g9j2-8w95-3vwv CVE-2026-55497 MODERATE 3 days ago

## Summary Cloudreve's built-in image processor decodes user-supplied images with Go's standard-library decoders (`image/png`, `image/jpeg`, `imag...

go

No PRs yet

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

GHSA-8r7f-r8hj-r3rv CVE-2026-55496 MODERATE 3 days ago

## Summary `GET /api/v4/user/search` is available to any logged-in user. The service calls `userClient.SearchActive`, but despite its name that m...

go

No PRs yet

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

GHSA-49h3-cwhj-4737 CVE-2026-55495 MODERATE 3 days ago

## Summary Cloudreve's WOPI `PUT_RELATIVE` handler treats `X-WOPI-SuggestedTarget` as a path, not a filename. It splits the header on `/` and joi...

go

No PRs yet

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

GHSA-6v4j-43gg-vj32 CVE-2026-55404 HIGH 3 days ago

### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead t...

pypi

No PRs yet

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

GHSA-gh7p-78x6-jw6m CVE-2026-59222 MODERATE 3 days ago

### Summary The channel members endpoint serializes and returns **full user models** for channel participants, including settings objects. A norma...

pypi

No PRs yet

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

GHSA-73x5-h92w-xc2j CVE-2026-59215 LOW 3 days ago

## Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. `GET /api/v1/channels/{id}/me...

pypi

No PRs yet

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

GHSA-3wp3-xxj9-5jqq CVE-2026-59213 LOW 3 days ago

## Summary The `get_all_models` handlers in `routers/openai.py` and `routers/ollama.py` intended to cache their **permission-filtered** model list...

pypi

No PRs yet

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

GHSA-7r7x-gjvr-448g CVE-2026-59217 MODERATE 3 days ago

# Open WebUI upload metadata can add files to knowledge bases without write permission ## Summary Open WebUI's file upload background processing ...

pypi

No PRs yet

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

GHSA-74h3-cxq7-vc5q CVE-2026-59216 HIGH 3 days ago

## Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside **another** user's authenticated ses...

pypi

No PRs yet

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

GHSA-x2ff-v5v8-m75m CVE-2026-59714 HIGH 3 days ago

## Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by...

pypi

No PRs yet

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

GHSA-855v-hq7w-jmjw CVE-2026-59219 HIGH 3 days ago

## Summary With Redis configured, Open WebUI supports JWT revocation: `POST /api/v1/auths/signout` (per-token `jti`) and OIDC back-channel logout ...

pypi

No PRs yet

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

GHSA-gmfw-g93r-vg53 CVE-2026-59715 LOW 3 days ago

## Summary The Socket.IO server is configured with `always_connect=True` (lines 78, 91 in `backend/open_webui/socket/main.py`) and the `connect` h...

pypi

No PRs yet

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

GHSA-rqj7-6wrp-6g2g CVE-2026-59227 MODERATE 3 days ago

## Summary `POST /api/v1/images/edit` performed no authorization beyond requiring a verified account. Every other image-editing surface in Open We...

pypi

No PRs yet

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

GHSA-ffpj-xv5c-p3gw CVE-2026-59220 MODERATE 3 days ago

## Summary Two regexes in `backend/open_webui/utils/middleware.py` that parse `<$skillId|label>` skill-mention tags backtrack in O(n²) on input tha...

pypi

No PRs yet

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

GHSA-mvx4-532p-xfm9 CVE-2026-59226 LOW 3 days ago

**Title:** Scheduled automations continue after pending-user deactivation and stored model ACL revocation ### Summary Open WebUI documents `pendi...

pypi

No PRs yet

Open WebUI: Account enumeration via observable login timing discrepancy

GHSA-7rw5-9f7q-xj36 CVE-2026-59218 MODERATE 3 days ago

### Summary The `/api/v1/auths/signin` endpoint leaked whether an email address belonged to a registered account through a response-time side chan...

pypi

No PRs yet

Open WebUI: Stored web worker XSS via Pyodide

GHSA-4r2p-27mh-5m22 CVE-2026-59214 HIGH 3 days ago

**Title:** Same-origin Pyodide code execution allows server-side RCE via a shared chat ### Summary Open WebUI runs client-side Python (Pyodide) i...

pypi

No PRs yet