Security Advisory

CVE-2025-63681

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-12-04 00:00:00

Last updated 2025-12-05 19:51:31

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.

← Browse all CVEs View on cve.org ↗