Executive brief
Open WebUI, a user interface for interacting with large language models, is vulnerable to unauthorized data access. An attacker with a valid account can bypass access controls to extract content from private files and knowledge bases belonging to other users. This means that even if a user revokes access to a document, an attacker who previously knew the document's ID can still query its contents through the chat interface.
Technical details
A missing authorization check exists in the `get_sources_from_items` function within `backend/open_webui/retrieval/utils.py`. While some code paths validate access using `has_access_to_file`, three specific paths (non-full-context file queries, text queries with collection names, and bare collection names) pass user-supplied IDs directly to `query_collection()` without verification. An authenticated attacker who knows or can predict a target's file ID or knowledge base UUID can craft a chat completion request to extract private data from the vector store. This vulnerability effectively bypasses access revocation, as the vector store remains queryable regardless of the current file permissions. The issue is patched in version 0.9.0.
Affected products
- Open WebUI open-webui <= 0.8.12
Timeline
- 2026-05-05: disclosed: Initial disclosure by reporter
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-08: patched: Version 0.9.0 released