Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach…
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Record
- CVE-2026-45402
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied file_id and attach the referenced file to a resource the caller controls (folder knowledge, knowledge-base contents) without verifying that the caller owns or has been granted access to the file. The file's content then becomes reachable through the downstream RAG / file-content paths, allowing any authenticated user to exfiltrate any other user's private file — and on the knowledge-base path, also to overwrite it — given knowledge of the file's UUID. This affects backend/open_webui/routers/folders.py (POST /api/v1/folders/{id}/update), backend/open_webui/routers/knowledge.py (add_file_to_knowledge_by_id), and backend/open_webui/routers/knowledge.py (add_files_to_knowledge_by_id_batch). This vulnerability is fixed in 0.9.5.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat interface for using AI language models that your organization can run on its own server, even fully offline. This flaw affects all versions before 0.9.5. It is in the features that let users attach reference files to a folder and to a knowledge base. Any user with an account who knows the unique identifier of another user's file could attach that file to their own folder or knowledge base and read its contents. Through the knowledge base feature, they could also overwrite that file. This flaw is rated High.
What to do
- If you are not sure who looks after Open WebUI for your organization, find that out first, since only that person or company can make the update.
- If someone in your organization installed and runs Open WebUI, ask that person to update it to version
0.9.5or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update will be done.
- Once the update is done, have them check that Open WebUI shows version
0.9.5or later.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.