Executive brief
Open WebUI is an interface for interacting with large language models. A security flaw in its retrieval system allows any logged-in user to access, modify, or delete private knowledge bases belonging to other users if they know the target's unique identifier. This could lead to the exposure of sensitive documents, the injection of malicious data into AI responses, or the complete loss of a user's stored information.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `_validate_collection_access` function within `backend/open_webui/routers/retrieval.py`. The function only validates collection names starting with specific prefixes (`user-memory-` and `file-`), failing to check knowledge base collections which use raw UUIDs. An authenticated attacker who knows a victim's knowledge base UUID can use the `/api/v1/retrieval/query/*` endpoints to read content or the `/api/v1/retrieval/process/*` endpoints to inject or overwrite data. While UUIDs are not guessable, they leak through model metadata, shared chat citations, and browser URLs. The vulnerability is patched in version 0.9.5.
Affected products
- Open WebUI Open WebUI <= 0.9.4
Timeline
- 2026-03-26: other: Vulnerability reproduced on main branch (v0.8.11)
- 2026-05-10: disclosed: Initial disclosure on GitHub Advisory Database
- 2026-05-14: advisory: Advisory updated
References
- https://api.github.com/users/tenbbughunters
- https://github.com/tenbbughunters
- https://api.github.com/users/tenbbughunters/gists%7B/gist_id%7D
- https://api.github.com/users/tenbbughunters/repos
- https://avatars.githubusercontent.com/u/152317477?v=4
- https://api.github.com/users/tenbbughunters/events%7B/privacy%7D