CP
cyberpings
VulnerabilitiesHIGH

Broken Access Control - High Risk in Open WebUI Discovered

Featured image for Broken Access Control - High Risk in Open WebUI Discovered
FDFull Disclosure
CVE-2026-34222Open WebUISEC Consult
🎯

Basically, a flaw in Open WebUI lets some users see secret information they shouldn't.

Quick Summary

A serious vulnerability has been found in Open WebUI, allowing low-privileged users to access sensitive data. This flaw, CVE-2026-34222, poses a high risk. Users must update to the latest version to secure their systems.

What Happened

SEC Consult Vulnerability Lab has disclosed a serious vulnerability in Open WebUI, a self-hosted AI interface. This flaw, identified as CVE-2026-34222, involves broken access control in the Tool Valves feature. It allows low-privileged users to access sensitive data, including API keys, which should only be available to administrators.

The Flaw

The vulnerability arises from improper restrictions on the Tool Valves endpoint. This endpoint should only allow administrators to access certain configurations. However, due to a lack of proper checks, a user with merely 'Member' privileges can retrieve sensitive information. This could lead to unauthorized access to third-party systems, significantly compromising security.

What's at Risk

The potential impact of this vulnerability is high. If exploited, it could allow an attacker to gain access to sensitive API keys and other configurations that could be used to manipulate or extract data from connected systems. Such access could lead to data breaches or unauthorized actions within the organization.

Patch Status

The vendor has released a patched version, v0.8.11, which addresses this vulnerability. Users are strongly advised to upgrade to this version to mitigate risks associated with this flaw. The patch can be found on the official Open WebUI GitHub releases page.

Immediate Actions

  • Update Open WebUI to version v0.8.11 immediately.
  • Conduct a thorough security review of your Open WebUI setup to identify any other potential vulnerabilities.
  • Monitor for any unusual activity that may indicate exploitation of this flaw.

Conclusion

This vulnerability highlights the critical importance of proper access controls in software applications. Organizations using Open WebUI should prioritize applying the patch and reviewing their security posture to protect against potential exploitation.

🔒 Pro insight: The lack of proper access controls in Open WebUI underscores the need for rigorous security reviews in software development.

Original article from

FDFull Disclosure
Read Full Article

Share

Related Pings

HIGHVulnerabilities

CVE-2026-33691 - OWASP CRS Whitespace Padding Bypass Alert

A new vulnerability in OWASP CRS allows attackers to upload dangerous files by exploiting whitespace in filenames. This affects many web applications, risking severe security breaches. Immediate updates are necessary to protect your systems.

Full Disclosure·
HIGHVulnerabilities

Local Privilege Escalation - Vulnerability in Vienna Assistant

A vulnerability in Vienna Assistant for MacOS allows attackers to escalate privileges and execute commands. Users are urged to contact the vendor for a fix. This flaw poses a high risk to system security.

Full Disclosure·
HIGHVulnerabilities

MetInfo CMS Vulnerability - PHP Code Injection Risk

A critical vulnerability in MetInfo CMS could let attackers execute arbitrary PHP code. Versions 7.9, 8.0, and 8.1 are at risk. Stay alert for updates and potential fixes.

Full Disclosure·
HIGHVulnerabilities

Cisco IMC Auth Bypass - Critical Vulnerability Patched

What Happened Cisco has released urgent patches for a critical vulnerability in its Integrated Management Controller (IMC), affecting many of its servers and appliances. This flaw allows unauthenticated remote attackers to gain admin access, enabling them to control servers even when the main operating system is shut down. The vulnerability is tracked as CVE-2026-20093 and arises from improper handling

CSO Online·
HIGHVulnerabilities

RosarioSIS 6.7.2 - Critical XSS Vulnerability Discovered

A critical XSS vulnerability has been found in RosarioSIS 6.7.2. This flaw could allow attackers to execute harmful scripts on users' browsers. Users are urged to monitor for updates and take precautions to safeguard their data.

Exploit-DB·
HIGHVulnerabilities

phpMyAdmin 5.0.0 - Critical SQL Injection Vulnerability

A critical SQL injection vulnerability has been found in phpMyAdmin 5.0.0. This puts databases at risk of unauthorized access and data manipulation. Immediate updates are necessary to protect sensitive information.

Exploit-DB·