What is GHSA-x8qf-hm43-c9g2?

GHSA-x8qf-hm43-c9g2 is a security advisory published by GitHub Security Advisories with High severity. Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in...

Which CVE IDs does GHSA-x8qf-hm43-c9g2 cover?

GHSA-x8qf-hm43-c9g2 covers the following CVE IDs: CVE-2026-109286. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x8qf-hm43-c9g2?

GHSA-x8qf-hm43-c9g2 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-x8qf-hm43-c9g2HighCVSS 8.1

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-109286 →

📋 Description

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.

🔗 References (4)

https://github.com/open-webui/open-webui/security/advisories/GHSA-vpq8-f445-hcq7
https://nvd.nist.gov/vuln/detail/CVE-2026-109286
https://www.vulncheck.com/advisories/open-webui-0.7.0-before-0.11.4-session-token-theft-via-syncstatsmodal
https://github.com/advisories/GHSA-x8qf-hm43-c9g2