Executive brief
Open WebUI is an interface for interacting with large language models. A security flaw allows users who have been granted permission to read a file to escalate their privileges and modify or delete that file. This could lead to unauthorized data loss or tampering with shared knowledge bases within the platform.
Technical details
An incorrect authorization vulnerability exists in Open WebUI's model metadata handling. The `_verify_knowledge_file_access` function only validates that a user has 'read' access before allowing a file ID to be added to a model's `meta.knowledge` field. However, the `has_access_to_file` function subsequently grants 'write' access to any file referenced in a model that the user owns. An attacker can exploit this by creating or updating a model to include a file they only have read access to, thereby gaining the ability to rename, update, or delete that file via the `/api/v1/files` endpoints. This issue was addressed in version 0.10.0.
Affected products
- Open WebUI open-webui >= 0.9.6, < 0.10.0
Timeline
- 2026-07-02: disclosed: Vulnerability reported to vendor
- 2026-07-09: advisory: NVD publication date
- 2026-07-24: patched: GitHub Advisory published and fix confirmed in v0.10.0