https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 17:56:56 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-109284 <p>Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat&#39;s folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.</p> <p>Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat&#39;s folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.</p> https://db.gcve.eu/vuln/fkie_cve-2026-109284 https://db.gcve.eu/vuln/ghsa-4qmj-5jg3-qp9m <p>Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat&#39;s folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.</p> <p>Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat&#39;s folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.</p> https://db.gcve.eu/vuln/ghsa-4qmj-5jg3-qp9m