Open WebUI: Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-45398
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, _validate_collection_access() checks the user-memory-* and file-* collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any authenticated user who knows a private knowledge base UUID can read its content through the retrieval query endpoints, even though the knowledge API correctly denies that user access. The same gap affects the retrieval write endpoints (/process/text, /process/file, /process/files/batch, /process/web, /process/youtube), allowing an attacker to inject content into or overwrite another user's knowledge base. This vulnerability is fixed in 0.9.5.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat interface for AI models that your organization runs on its own computers, and it can work entirely offline. This flaw affects versions before 0.9.5. It sits in the part of the product that searches and adds documents to knowledge bases, which are collections of documents users give the AI to draw on. Any user who can log in and knows the unique ID of someone else's private knowledge base can read its contents, even though the product normally blocks that user. The same user could also add content to, or overwrite, another user's knowledge base. This flaw is rated High.
What to do
- Find out whether your organization uses Open WebUI, and if so, which version it runs. Any version before
0.9.5has this flaw. - If you or someone on your staff installed and runs Open WebUI, that person should update it to version
0.9.5or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update will be done.
- If you are unsure who looks after Open WebUI, ask whoever set up your organization's AI tools, and share the vendor advisory linked on this page with them.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.