CVE-2025-63681 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, ena…
Medium CVSS: 4.3

CVE-2025-63681

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.
Vendor
Openwebui
Product
Open Webui
CWE
NVD-CWE-noinfo
Yayın Tarihi
2025-12-04 16:16:22
Güncelleme
2025-12-05 20:15:57
Source Identifier
cve@mitre.org
KEV Date Added
-

Kategoriler

NVD-CWE-noinfo Open Webui MEDIUM Openwebui 2025

Referanslar

https://github.com/TOAST-Research/pocs/blob/main/openwebui/arbitirary_task_stop/report.md https://github.com/open-webui/open-webui/blob/46ae3f4f5d7d4d706041bdae4ad2d802e568712b/backend/open_webui/main.py#L1652 https://github.com/TOAST-Research/pocs/blob/main/openwebui/arbitirary_task_stop/report.md