Executive brief
Open WebUI, a user interface for interacting with large language models, contains a vulnerability that allows authenticated users to access files belonging to other users. By crafting a specific chat request with a known file identifier, an attacker can bypass permission checks and view the contents of private documents. This could lead to the unauthorized disclosure of sensitive information stored within the platform.
Technical details
A missing authorization check (CWE-862) exists in the chat completion, chat completed, and chat action endpoints of Open WebUI. While saved workspace models have their file references validated at creation, 'inline' models defined directly in a chat request bypass these checks. An attacker with a valid session and knowledge of a target file's UUID can attach that file to an inline model; the backend's builtin knowledge tools then trust this metadata and return the file's indexed content. The attack requires the attacker to already possess the non-enumerable UUID of the target file. The issue is fixed in version 0.11.0 by implementing access filtering on inline model metadata.
Affected products
- Open WebUI open-webui >= 0.8.8, <= 0.10.2
Timeline
- 2026-08-02: disclosed
- 2026-08-04: advisory: GHSA-6xhv-rxhv-pwm4 published
- 2026-08-04: patched: Fixed in version 0.11.0