Open WebUI: Forged chat-file link allows cross-user file read and deletion
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- Record
- CVE-2026-54010
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- July 20, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach arbitrary file_id values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, has_access_to_file() treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file. This vulnerability is fixed in 0.9.6.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat program for using artificial intelligence (AI) models that your organization runs on its own computers. This flaw affects versions before 0.9.6. It is in the part of the product that handles files attached to chats. Anyone with an account can attach another user's files to their own chat message, because the product does not check whether they own those files. By sharing that chat and giving themselves read access, they can then read or delete those files, even though the files belong to someone else. This flaw is rated High.
What to do
- If you are not sure whether your organization uses Open WebUI, ask whoever looks after your computers before deciding this does not apply to you.
- The person who installed or runs Open WebUI for your organization should update it to version
0.9.6or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to
0.9.6will be done. - After the update, have that person check that Open WebUI shows version
0.9.6or later, so you know the fix is in place.
Analysis written from the source record as of July 20, 2026 and reviewed before publishing.