Executive brief
Open WebUI is an interface for interacting with large language models and managing shared knowledge bases. A flaw in the file upload process allows users who only have permission to read a knowledge base to instead add their own files to it. This could lead to unauthorized data being shared with other users or the poisoning of AI responses if the unauthorized files are used for training or retrieval.
Technical details
An authorization bypass exists in Open WebUI's file upload background processing. The application trusts the client-supplied 'metadata.knowledge_id' value and creates a 'knowledge_file' association in the database before validating the user's write permissions for that specific knowledge base. While a later vector processing check may fail, the database relationship is already committed, granting the file membership in the knowledge base. An authenticated attacker with read-only access can exploit this to inject arbitrary files into shared knowledge bases, potentially leading to RAG (Retrieval-Augmented Generation) content poisoning. The issue is fixed in version 0.10.0.
Affected products
- Open WebUI Open WebUI < 0.10.0
Timeline
- 2026-07-02: disclosed: Initial disclosure on GitHub
- 2026-07-24: advisory: GitHub Advisory published