漏洞公告

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

Flowise: Missing Authorization on Execution Update Endpoint

Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise: Incomplete Credential Redaction Exposes Secrets via API

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

Flowise RCE via SQLite Record Manager Node

Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses