CVE-2026-109572 | BDVDB-2026-386455 Detail

Description#

Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-12Record published in the CVE List.
2. Version 22026-10-23Most recent update recorded in the CVE List.