high7.6
CVE-2026-109572
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals …
Impact
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.
Affected products
| Product | Affected versions |
|---|---|
| Open WebUI From 0.8.6 | before 0.11.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.