CVE-2026-45301
HighSummary
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.3.16 had a missing permission check in files related to API endpoints. This allowed any authenticated user to list, access, and delete every file uploaded by other users.
Risk Assessment
The lack of permission checks poses a serious risk to user data privacy and platform security, as any user could manipulate files belonging to others.
Recommendation
It is recommended to upgrade to version 0.3.16 or later to fix this vulnerability and secure user file access.
Original NVD description (English source)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.