CVE-2026-54007: Openwebui Open Webui

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt() in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthorized POST /api/v1/chats/new and POST /api/chat/completions requests containing attacker-controlled prompts. This enables cross-site forced actions and model/tool execution under victim privileges without consent. This vulnerability is fixed in 0.9.6.

Affected products

• Openwebui Open Webui: before 0.9.6 (fixed in 0.9.6)

Published 2026-06-23. Last modified 2026-06-26.