Get real-time updates on Telegram
P4Verified
CVE-2026-109285: open-webui 0.6.0 to before 0.11.4
CVE-2026-109285. CVSS 3.1 base score 5.0 (GitHub Advisory Database).
Affected technology
open-webui · 0.6.0 to before 0.11.4
open-webui
Description’s affected range: before 0.11.4
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases. Vendor/CNA’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality, integrity and availability impact as low.
- CWE
- CWE-863
- CCR priority
- 20.0 /100 (P4)
- CVSS 3.1
- 5.0 /10 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L · GitHub Advisory Database
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-13 02:51:46.931182+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-13 01:49:08.152775+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-109285.html