CVE-2026-87017: Open WebUI knowledge tool authorization bypass

Executive brief

Open WebUI's built-in knowledge search tool exposes metadata from knowledge bases that users should not have access to. When using most external vector databases (such as Qdrant, Elasticsearch, OpenSearch, or Milvus) instead of the default Chroma backend, the application fails to enforce access controls on knowledge base searches, allowing any authenticated user to discover and enumerate sensitive knowledge base names and descriptions that were never shared with them. This affects deployments that have deliberately switched to external vector stores, typically larger installations.

Technical details

The vulnerability is an incorrect authorization (CWE-863) and sensitive information exposure (CWE-200) in the knowledge base search functionality. The built-in knowledge search tool constructs a filter of authorized knowledge bases and passes it to the vector database's search method with the expectation that the filter will be applied. However, eleven of the fifteen shipped vector backends (both Qdrant clients, Elasticsearch, OpenSearch, both Milvus clients, openGauss, Oracle 23ai, Pinecone, S3 Vectors, and Weaviate) declare a filter parameter but never apply it in their search implementations, while their query methods correctly apply filtering. The default Chroma backend and pgvector, MariaDB, and Valkey backends are unaffected. An authenticated user without elevated privileges can call a model configured with the knowledge tool enabled (the default) to enumerate all knowledge base identifiers, names, and descriptions in the shared collection, regardless of access restrictions. The exposure is limited to metadata; actual document text is stored in separate per-knowledge-base collections and is not returned. Fixed in version 0.11.1 by ensuring all backends apply the caller-supplied filter in their search method.

Affected products

• Open WebUI open-webui 0.7.0 to 0.11.0

Timeline

• 2026-09-10: disclosed: Vulnerability published in GitHub Advisory Database
• 2026-09-10: patched: Fix available in version 0.11.1 via commit 1d6d4e6e6

References

• https://api.github.com/users/Classic298
• https://github.com/Classic298
• https://api.github.com/users/Classic298/gists%7B/gist_id%7D
• https://api.github.com/users/Classic298/repos
• https://avatars.githubusercontent.com/u/27028174?v=4
• https://api.github.com/users/Classic298/events%7B/privacy%7D