Executive brief
Open WebUI, a user interface for interacting with large language models, contains a flaw in its notes feature. An authenticated user can access, modify, or delete notes belonging to other users by manipulating the note identifier in web requests. This could lead to the exposure of private conversations, sensitive uploaded data, or confidential information stored within the application.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Open WebUI notes API endpoints, specifically `/api/v1/notes/{note_id}`. The application fails to perform adequate authorization checks to ensure that the requesting user has permission to access the specific `note_id`. An authenticated attacker can enumerate or guess UUIDs of notes belonging to other users to retrieve, update, or delete them. Additionally, even if the notes feature is disabled in the UI, an attacker can re-enable it via the `/api/config` endpoint to facilitate the exploit. The vulnerability is addressed in version 0.8.11 by implementing ownership and AccessGrants checks on all per-ID note endpoints.
Affected products
- Open WebUI open-webui <= 0.8.10
Timeline
- 2026-03-01: patched: First released in v0.8.11
- 2026-05-11: disclosed
- 2026-05-14: advisory
References
- https://api.github.com/users/zeeshanyshaikh
- https://github.com/zeeshanyshaikh
- https://api.github.com/users/zeeshanyshaikh/gists%7B/gist_id%7D
- https://api.github.com/users/zeeshanyshaikh/repos
- https://avatars.githubusercontent.com/u/6223015?v=4
- https://api.github.com/users/zeeshanyshaikh/events%7B/privacy%7D