CVE-2026-45402: Open WebUI authorization bypass in folder and knowledge-base endpoints

Executive brief

Open WebUI is an interface for interacting with large language models. A security flaw allows any logged-in user to access or modify private files uploaded by other users if they know the file's unique identifier. This could lead to the exposure of sensitive documents or the unauthorized modification of data used by the AI to generate responses.

Technical details

The vulnerability exists in multiple API endpoints, including /api/v1/folders/{id}/update and /api/v1/knowledge/{id}/file/add, which fail to verify if the requesting user has permission to access a provided file_id. By attaching a victim's file UUID to their own folder or knowledge base, an attacker can force the system to include that file in RAG (Retrieval-Augmented Generation) contexts or gain direct read/write access via the files API. While file UUIDs are not easily guessable, they may leak through chat citations, shared workspace metadata, or browser history. The issue is addressed in version 0.9.5.

Affected products

• Open WebUI open-webui <= 0.9.4

Timeline

• 2026-05-10: disclosed
• 2026-05-14: advisory: GitHub Advisory published
• 2026-05-14: patched: Version 0.9.5 released

References

• https://api.github.com/users/MrBeard-FT
• https://github.com/MrBeard-FT
• https://api.github.com/users/MrBeard-FT/gists%7B/gist_id%7D
• https://api.github.com/users/MrBeard-FT/repos
• https://avatars.githubusercontent.com/u/259396703?v=4
• https://api.github.com/users/MrBeard-FT/events%7B/privacy%7D