https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:58:56 +0000 https://db.gcve.eu/vuln/bdu:2026-07197 bdu:2026-07197 https://db.gcve.eu/vuln/bdu:2026-07197 https://db.gcve.eu/vuln/fkie_cve-2026-45395 <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the workspace.tools permission check that is present on the tool create endpoint. This allows a user who has been explicitly denied tool management capabilities ( and who the administrator considers untrusted for code execution ) to replace a tool&#39;s server-side Python content and trigger execution, bypassing the intended workspace.tools security boundary. This vulnerability is fixed in 0.9.5.</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the workspace.tools permission check that is present on the tool create endpoint. This allows a user who has been explicitly denied tool management capabilities ( and who the administrator considers untrusted for code execution ) to replace a tool&#39;s server-side Python content and trigger execution, bypassing the intended workspace.tools security boundary. This vulnerability is fixed in 0.9.5.</p> https://db.gcve.eu/vuln/fkie_cve-2026-45395 https://db.gcve.eu/vuln/ghsa-p4fx-23fq-jfg6 <p><strong>Affected:</strong> npm: open-webui</p> <p>### Summary</p> <p>The tool update endpoint (`POST /api/v1/tools/id/{id}/update`) is missing the `workspace.tools` permission check that is present on the tool create endpoint. This allows a user who has been explicitly **denied** tool management capabilities ( and who the administrator considers **untrusted** for code execution ) to replace a tool&#39;s server-side Python content and trigger execution, bypassing the intended `workspace.tools` security boundary.</p> <p>Open WebUI&#39;s security policy correctly states that `workspace.tools` is the trust boundary for code execution: *&#34;Granting a user the ability to create Tools is equivalent to giving them shell access to the server.&#34;* This vulnerability breaks that boundary. A `write` access grant on a single tool is sufficient to bypass `workspace.tools` entirely.</p> <p>This is **not** a report about exec() being unsandboxed (that is acknowledged as intended behavior). This is a report about a **missing authorization check** that allows an untrusted user to reach the exec() sink that should be gated behind `workspace.tools`.</p> <p>### Root Cause</p> <p>The create and update endpoints for tools have **asymmetric authorization checks**. The create endpoint enforces the `workspace.tools` permission; the update endpoint does not.</p> <p>#### Create endpoint, enforces `workspace.tools`</p> <p>**File**: `backend/open_webui/routers/tools.py`, lines 326-345</p> <p>```python @router.post(&#39;/create&#39;, response_model=Optional[ToolResponse]) async def create_new_tools( request: Request…</p> <p><strong>Affected:</strong> npm: open-webui</p> <p>### Summary</p> <p>The tool update endpoint (`POST /api/v1/tools/id/{id}/update`) is missing the `workspace.tools` permission check that is present on the tool create endpoint. This allows a user who has been explicitly **denied** tool management capabilities ( and who the administrator considers **untrusted** for code execution ) to replace a tool&#39;s server-side Python content and trigger execution, bypassing the intended `workspace.tools` security boundary.</p> <p>Open WebUI&#39;s security policy correctly states that `workspace.tools` is the trust boundary for code execution: *&#34;Granting a user the ability to create Tools is equivalent to giving them shell access to the server.&#34;* This vulnerability breaks that boundary. A `write` access grant on a single tool is sufficient to bypass `workspace.tools` entirely.</p> <p>This is **not** a report about exec() being unsandboxed (that is acknowledged as intended behavior). This is a report about a **missing authorization check** that allows an untrusted user to reach the exec() sink that should be gated behind `workspace.tools`.</p> <p>### Root Cause</p> <p>The create and update endpoints for tools have **asymmetric authorization checks**. The create endpoint enforces the `workspace.tools` permission; the update endpoint does not.</p> <p>#### Create endpoint, enforces `workspace.tools`</p> <p>**File**: `backend/open_webui/routers/tools.py`, lines 326-345</p> <p>```python @router.post(&#39;/create&#39;, response_model=Optional[ToolResponse]) async def create_new_tools( request: Request…</p> https://db.gcve.eu/vuln/ghsa-p4fx-23fq-jfg6