Executive brief
Open WebUI, an interface for interacting with large language models, contains a flaw in how it manages user 'memories' (stored personal context or data). This vulnerability allows any logged-in user to view, delete, or restore the private memories of other users. This could lead to the exposure of sensitive personal information or corporate data stored within the AI's memory system.
Technical details
Open WebUI suffers from an Insecure Direct Object Reference (IDOR) and authorization bypass (CWE-639) within its memories API. While the standard GET endpoint correctly filters by user, the 'POST /api/v1/memories/query' endpoint fails to restrict results to the authenticated user's own data, leaking other users' memory contents. Additionally, the 'DELETE' and 'POST .../update' endpoints lack proper ownership checks, allowing any authenticated user with a known memory ID to delete or restore data. An attacker requires a valid low-privileged account to exploit these endpoints over the network. The vulnerability is addressed in version 0.6.19.
Affected products
- Open WebUI open-webui < 0.6.19
Timeline
- 2026-05-05: disclosed: Advisory published by doge-woof
- 2026-05-11: advisory: GitHub Advisory GHSA-hmjq-crxp-7rjw published
- 2026-05-15: other: NVD published CVE-2026-44570