Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Open WebUI: Calendar event re-parenting allows writing events into another user's calendar

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui

Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint

Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint

Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding