Executive brief
Open WebUI is a self-hosted platform for running artificial intelligence models. A security flaw allows logged-in users to access or delete files belonging to other users by manipulating chat message data. This could lead to the unauthorized exposure of sensitive documents or the loss of data stored within the platform.
Technical details
Open WebUI prior to version 0.9.6 contains an authorization bypass vulnerability. The application fails to validate file ownership or permissions when an authenticated user attaches a `file_id` to a chat message via the `/api/chat/completions` endpoint. By linking a victim's `file_id` to a chat they own and then sharing that chat, an attacker triggers a logic flaw in `has_access_to_file()`. This function incorrectly treats the victim file as accessible because it is associated with a shared chat the attacker has 'read' access to. Furthermore, the `DELETE` endpoint fails to verify the specific access type, allowing users with read-only access to a shared chat to delete any files attached to it. The issue is resolved in version 0.9.6.
Affected products
- Open WebUI Open WebUI < 0.9.6
Timeline
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date