CVE-2025-63681: Openwebui Open Webui

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.

Affected products

• Openwebui Open Webui: version 0.6.41 only

Published 2025-12-04. Last modified 2026-06-17.