{"id":"CVE-2026-109293","published":"2026-10-12T17:17:22.650","lastModified":"2026-10-13T20:39:48.767","description":"Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2","tags":[]},{"url":"https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-tool-source-disclosure-via-tool-export-endpoint","tags":[]},{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2","tags":[]}],"exploitRefs":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2","tags":[]},{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2","tags":[]}],"hasPoc":true,"ai":null}