PT-2026-41163 · Unknown · Open-Webui

Published 2026-03-08 · Updated 2026-05-16 · CVE-2026-45301

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.3.16

Description A missing permission check in API endpoints related to files allows any authenticated user to list, access, and delete every file uploaded by any user to the platform. The issue exists because the endpoints only verify if a user is authenticated but do not filter files to match the user id of the requesting user. Affected endpoints include '/api/v1/files/', '/api/v1/files/{id}/content', and '/api/v1/files/{id}'.

Recommendations Update to version 0.3.16.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2026-07137

CVE-2026-45301

GHSA-R8WH-8M7R-FH33

Affected Products

Open-Webui

References · 8

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-r8wh-8m7r-fh33 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45301 · Security Note
• https://osv.dev/vulnerability/GHSA-r8wh-8m7r-fh33 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07137 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/CVEnew/status/2055457499017248984 · Twitter Post
• https://t.me/CVEtracker/53974 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2055495442062844158 · Twitter Post