Mariuszmaik

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.8.6 **Description** Open WebUI is a self-hosted artificial intelligence platform designed for offline operation. A flaw exists where any authenticated user can access private memories and files belonging to other users. This is due to a lack of proper authorization checks when querying collections via the `/api/v1/retrieval/query/collection` API endpoint. Specifically, the `query collection handler` function in `backend/open webui/routers/retrieval.py` does not validate ownership of the requested collections. User information, including UUIDs, emails, names, and roles, can be enumerated through the `/api/v1/users/search` endpoint. The vulnerability allows unauthorized access to user data, including personal memories (when the Memory feature is enabled) and the full content and metadata of uploaded files. The API endpoint `/api/v1/retrieval/query/collection` is vulnerable, accepting a `collection names` parameter without verifying user ownership. The `user` variable, obtained through `Depends(get verified user)`, only confirms authentication, not authorization. File collections follow the pattern `file-{FILE UUID}`, and user memories use `user-memory-{USER UUID}`. **Recommendations** Versions prior to 0.8.6: Implement ownership validation within the `/api/v1/retrieval/query/collection` function to ensure users can only access collections they own or have permission to view. Versions prior to 0.8.6: Restrict access to the `/api/v1/users/search` endpoint to administrators only, or limit the information returned to non-privileged users.

Name of the Vulnerable Software and Affected Versions: gRPC-Go versions prior to 1.79.3 Description: gRPC-Go is vulnerable to an authorization bypass due to improper input validation of the HTTP/2 `:path` pseudo-header. The server incorrectly routes requests with missing leading slashes in the `:path` header, allowing attackers to bypass authorization checks if relying on path-based authorization interceptors (like `grpc/authz`) with a 'deny' rule for canonical paths and a fallback 'allow' rule. An attacker can exploit this by sending raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. There have been reports of increased actor activities targeting gRPC-Go (CVE-2026-33186). Recommendations: Upgrade to gRPC-Go version 1.79.3 or later. As a temporary workaround, implement a validating interceptor to reject requests with malformed paths, enforce infrastructure-level normalization of the `:path` header, or harden authorization policies to a 'default deny' posture.