Executive brief
Open WebUI, a self-hosted AI platform, contains a security flaw that allows any logged-in user to read the private notes of other users. By slightly modifying the request used to access a document, an attacker can bypass the system's ownership checks. This could lead to the exposure of sensitive personal information or proprietary data stored within the platform's note-taking feature.
Technical details
The vulnerability exists in the 'ydoc:document:join' Socket.IO handler within 'socket/main.py'. The handler only performs ownership validation if the 'document_id' starts with the 'note:' prefix. However, the underlying 'YdocManager' storage layer normalizes document IDs by replacing colons with underscores (e.g., 'note:123' becomes 'note_123'). An attacker can bypass the authorization check by requesting a document using the underscore format ('note_<id>'), which skips the prefix check but resolves to the same underlying Yjs document in the storage layer. This allows the attacker to receive the full document state via the 'ydoc:document:state' event. The issue is fixed in version 0.8.11.
Affected products
- open-webui open-webui < 0.8.11
Timeline
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date