CVE-2026-54015

Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Published Jun 23, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the prompt_id in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that prompt (history_entry.prompt_id == prompt.id). This affects /api/v1/prompts/id/{prompt_id}/history/diff, /api/v1/prompts/id/{prompt_id}/update/version, and /api/v1/prompts/id/{prompt_id}/history/{history_id}. An authenticated user with access to any prompt they control, plus a victim prompt_history.id, can read or delete another user's private prompt history. This vulnerability is fixed in 0.9.6.

Analysis

Technical impact

Open WebUI is a self‑hosted artificial intelligence platform that operates entirely offline. In versions before 0.9.6, its prompt‑version history API endpoints validate the prompt ID supplied in the URL but then use a caller‑supplied history ID without verifying that the history record belongs to that prompt. Consequently, any authenticated user who has control over a prompt and can determine or guess a victim’s prompt_history.id can read or delete that user's private prompt history. This is an IDOR vulnerability (CWE‑639) compounded by insufficient authorization controls (CWE‑284).

Affected Systems

The flaw exists in the open‑webui:open‑webui product on all releases prior to version 0.9.6. Any self‑hosted installation running an older version is vulnerable.

Risk and Exploitability

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated and have ownership of at least one prompt, then acquire a victim’s history ID (which can be guessed or enumerated via API). Once these prerequisites are satisfied, the attacker can issue requests to read or delete the victim’s prompt history by hitting the exposed endpoints. The likely attack vector is an authenticated API request over the network; this is inferred from the description of the affected endpoints.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

open-webui

affected

Version	Status	Constraints
`< 0.9.6`	affected	—

Configuration 1 [-]

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Open-webui

Version	Status	Scheme	Platform
`[0,0.9.6)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Open WebUI to version 0.9.6 or newer to apply the strict access controls so users can only request history entries belonging to prompts they own; implement ownership validation in future versions or custom patches.
Monitor API usage for anomalous read or delete requests against prompt history and review logs for potential abuse.
Audit access logs to detect unauthorized read or delete actions and investigate any breaches.

Generated by OpenCVE AI on June 24, 2026 at 10:55 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-4r4w-2wgp-w7cj	Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.269% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/open-webui/open-webui/security/advisories/GHSA-4r4w-2wgp-w7cj

History

Jun 24, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Open-webui Open-webui open-webui
Vendors & Products		Open-webui Open-webui open-webui

Jun 23, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the prompt_id in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that prompt (history_entry.prompt_id == prompt.id). This affects /api/v1/prompts/id/{prompt_id}/history/diff, /api/v1/prompts/id/{prompt_id}/update/version, and /api/v1/prompts/id/{prompt_id}/history/{history_id}. An authenticated user with access to any prompt they control, plus a victim prompt_history.id, can read or delete another user's private prompt history. This vulnerability is fixed in 0.9.6.
Title		Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
Weaknesses		CWE-284 CWE-639
References		https://github.com/open-webui/open-webui/security/advisories/GHSA-4r4w-2wgp-w7cj
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L'}`