CVEFinder.io

CVE-2026-59216

⚠ī¸ high
🔍 Scan for this CVE
Summary

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the session was connected, allowing authenticated users who learned another socket ID through ydoc:document:join to run code interpreter Python or tools in that user session. This issue is fixed in version 0.10.0.

CVSS Score
7.7
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-07-09
First Seen: 2026-07-10
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.4% of all 338,292 vulnerabilities in our database.

#103,391
Above average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jul 9, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-07-13
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CWE IDs (Weakness Types)
CWE-94 CWE-200 CWE-639 CWE-862

đŸ“Ļ Affected Products 1

Vendor Product Status Affected Versions
openwebui open_webui Affected
< 0.10.0

🔗 References 4

https://github.com/open-webui/open-webui/commit/386a...
Patch
https://github.com/open-webui/open-webui/pull/25763
Issue Tracking Patch
https://github.com/open-webui/open-webui/releases/ta...
Product Release Notes
https://github.com/open-webui/open-webui/security/ad...
Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-56398 ⚠ī¸ high 7.3 0.3 Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the ... 2026-07-15
CVE-2026-56400 ⚠ī¸ high 8.3 0.3 open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow... 2026-07-15
CVE-2026-59212 đŸ”ļ medium 5.4 0.3 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_... 2026-07-09
CVE-2026-59213 ℹī¸ low 3.5 0.3 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all... 2026-07-09
CVE-2026-59214 ⚠ī¸ high 7.3 0.3 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs c... 2026-07-09
CVE-2026-59215 ℹī¸ low 3.1 0.3 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa... 2026-07-09
These CVEs affect the same products