CVE-2026-45402
HighSummary
Open WebUI prior to version 0.9.5 has a vulnerability that allows users to attach files to resources they do not have permission for, potentially leading to the exfiltration of other users' private files.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data, which could lead to privacy breaches and loss of user trust.
Recommendation
It is recommended to upgrade Open WebUI to version 0.9.5 or later to mitigate this vulnerability.
Original NVD description (English source)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied file_id and attach the referenced file to a resource the caller controls (folder knowledge, knowledge-base contents) without verifying that the caller owns or has been granted access to the file. The file's content then becomes reachable through the downstream RAG / file-content paths, allowing any authenticated user to exfiltrate any other user's private file — and on the knowledge-base path, also to overwrite it — given knowledge of the file's UUID. This affects backend/open_webui/routers/folders.py (POST /api/v1/folders/{id}/update), backend/open_webui/routers/knowledge.py (add_file_to_knowledge_by_id), and backend/open_webui/routers/knowledge.py (add_files_to_knowledge_by_id_batch). This vulnerability is fixed in 0.9.5.