6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54015

CVE-2026-54015: Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the prompt_id in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that prompt (history_entry.prompt_id == prompt.id). This affects /api/v1/prompts/id/{prompt_id}/history/diff, /api/v1/prompts/id/{prompt_id}/update/version, and /api/v1/prompts/id/{prompt_id}/history/{history_id}. An authenticated user with access to any prompt they control, plus a victim prompt_history.id, can read or delete another user's private prompt history. This vulnerability is fixed in 0.9.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54015

CVE-2026-54015:

6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	<= 0.9.5	0.9.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) affecting three prompt history operations in Open WebUI. An authenticated attacker can read or delete prompt history entries belonging to other users.

The root cause is a failure to verify object ownership. The API endpoints (/api/v1/prompts/id/{prompt_id}/...) correctly authorize the user's access to the prompt_id specified in the URL. However, the backend functions that perform the history operations (compute_diff, delete_history_entry, update_prompt_version) subsequently use a history_id or version_id provided by the user in the request parameters or body, without checking if that history object actually belongs to the authorized prompt_id.

This allows an attacker to:

Read history: By calling the diff endpoint with their own prompt_id but the victim's history_id, they can retrieve snapshots of the victim's private prompts.
Read history (via restore): By calling the update/version endpoint with their own prompt_id but the victim's version_id, they can restore the victim's prompt content into their own prompt, making it readable.
Delete history: By calling the delete endpoint with their own prompt_id but the victim's history_id, they can delete the victim's prompt history entries.

The fix, implemented in commit 9a3eea64489df6dd2f48d4734a700de08dee0f13, addresses this by passing the authorized prompt_id down to the model-layer functions and adding it to the database queries. This ensures that all operations on history entries are scoped to the prompt the user is authorized to access, effectively closing the IDOR vulnerability.

The vulnerable functions are the API route handlers in routers/prompts.py that receive the malicious input, and the underlying data model methods in models/prompt_history.py and models/prompts.py that perform the database operations without proper authorization checks.

Vulnerable functions

open_webui.models.prompt_history.PromptHistories.compute_diff

backend/open_webui/models/prompt_history.py

The function originally fetched prompt history entries using only `from_id` and `to_id`, allowing an attacker to specify IDs from another user's prompt. The fix adds a `prompt_id` parameter and includes it in the database query to ensure the history entries belong to the authorized prompt.

open_webui.models.prompt_history.PromptHistories.delete_history_entry

backend/open_webui/models/prompt_history.py

The function deleted a history entry using only the `history_id`, which could belong to any user. The patch adds a `prompt_id` parameter to the function and the database query, restricting deletion to entries owned by the authorized prompt.

open_webui.models.prompts.Prompts.update_prompt_version

backend/open_webui/models/prompts.py

This function restored a prompt version using a `version_id` without checking if that version belonged to the current prompt. This allowed an attacker to restore and view another user's prompt content. The fix adds a check to ensure `history_entry.prompt_id` matches the authorized `prompt_id`.

open_webui.routers.prompts.get_prompt_diff

backend/open_webui/routers/prompts.py

This API route handler is the entry point for the diff-based information disclosure. It was vulnerable because it called the underlying `compute_diff` function without passing the authorized prompt ID, allowing the model layer to process arbitrary history IDs.

open_webui.routers.prompts.delete_prompt_history_entry

backend/open_webui/routers/prompts.py

This API route handler is the entry point for the history deletion vulnerability. It called the vulnerable `delete_history_entry` function without providing the authorized prompt ID, enabling an attacker to delete another user's prompt history.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.