https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T11:36:45.741689+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-109296 fkie_cve-2026-109296 2026-10-15T11:36:45.743253+00:00

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.

 https://db.gcve.eu/vuln/ghsa-32hx-qqmp-8j8q GHSA-32hx-qqmp-8j8q 2026-10-15T11:36:45.743314+00:00

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.