Executive brief
Open WebUI, a popular interface for interacting with large language models, contains a vulnerability that allows any logged-in user to view a list of all 'knowledge bases' created by other users. This metadata includes internal names, descriptions, and unique identifiers for private data collections. While it does not directly expose the full content of those files, it allows an attacker to discover sensitive project names and provides the necessary information to launch more advanced attacks against those private data stores.
Technical details
The `_validate_collection_access` function in `backend/open_webui/routers/retrieval.py` utilizes an incomplete allowlist that only enforces ownership checks for collections prefixed with `user-memory-` or `file-`. The system-level `knowledge-bases` meta-collection is not included in this check, allowing any authenticated user to query it via the `/api/v1/retrieval/query/doc` endpoint. An attacker can use this to enumerate the UUIDs, names, and descriptions of all knowledge bases on the instance. This disclosure facilitates further attacks, such as cross-user content injection or deletion, which require knowledge of a target's specific UUID. The issue is fixed in version 0.9.0.
Affected products
- Open WebUI open-webui <= 0.8.12
Timeline
- 2026-05-05: disclosed
- 2026-05-08: advisory: GHSA-6c2x-gcp3-gp73 published
- 2026-05-15: patched: NVD publication and patch confirmation