Open WebUI: Session token theft via cross-origin message handling in SyncStatsModal
Summary
Open WebUI versions 0.7.0 up to 0.11.3 accept verify:chat messages from any website in the SyncStatsModal component. A malicious page visited by a signed-in user can use a path-traversal chat ID to make the browser fetch the auths endpoint and return the user's JWT to the attacker. The attacker can then use the token for full API access as that user, including private chats. The attack requires that community sharing is enabled (default) and that the victim visits the attacker's page while signed in.
Affected
- Open WebUI 0.7.0 up to, but not including, 0.11.4
- Affected only if ENABLE_COMMUNITY_SHARING is enabled (default: True)
Fixed in
- Fixed in Open WebUI 0.11.4 (PR #29918)
Workaround
- No vendor workaround confirmed. Unknown whether disabling community sharing removes the exposure; the vendor describes deployments with community sharing disabled as not affected.
Exploitation
- Not marked as known exploited (KEV) at time of writing.
- EPSS 0.00145.
- No public proof of concept found; the vendor advisory describes a reproducible browser-based proof of concept.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Upgrade Open WebUI to 0.11.4 or later; check the Open WebUI releases page for the current latest release.
- Check whether any instance runs 0.7.0 to 0.11.3, and whether it is reachable from the internet.
- Rotate user sessions and tokens after patching.
- Ensure staff who use Open WebUI do not browse untrusted sites while signed in, as a mitigation until patching is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vpq8-f445-hcq7 github.com
- VulnCheck advisory www.vulncheck.com
- OSV record CVE-2026-109286 osv.dev
- OpenCVE CVE-2026-109286 app.opencve.io
- Rapid7 via Vulners CVE-2026-109286 vulners.com
- HOL CVE-2026-109286 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:45.
Original description (NVD)
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.