Executive brief
Open WebUI is a self-hosted platform for running artificial intelligence models offline. A security flaw allows users with model-creation permissions to bypass access controls and interact with files belonging to other users. By attaching a victim's file ID to a model's metadata, an attacker can read private documents or delete them entirely, potentially leading to data theft or loss of important information.
Technical details
Open WebUI prior to version 0.9.6 fails to validate ownership or read permissions when a user adds file IDs to a model's 'meta.knowledge' field during creation, update, or import. The application subsequently treats these metadata entries as a trusted authorization source. Specifically, the 'view_file' tool and the 'has_access_to_file()' function grant access based on the presence of a file ID in the model's metadata. An authenticated attacker with 'workspace.models' or 'workspace.models_import' permissions can exploit this to read extracted text via the 'view_file' tool, download full file contents via the API, or delete files belonging to other users. The fix in version 0.9.6 introduces proper validation for these metadata entries.
Affected products
- open-webui open-webui < 0.9.6
Timeline
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix confirmed in version 0.9.6