CVE-2026-109286 | Open WebUI up to 0.11.3 SyncStatsModal cross-domain policy

October 12, 2026 Yanac

A vulnerability was found in Open WebUI up to 0.11.3. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component SyncStatsModal. The manipulation leads to permissive cross-domain policy with untrusted domains.

This vulnerability is referenced as CVE-2026-109286. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More