PT-2026-50484 · Unknown · Open-Webui
CVSS v3.1
7.1
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Open WebUI versions prior to 0.9.6
Description
Open WebUI allows users with permissions to create, update, or import workspace models to store arbitrary
meta.knowledge entries without verifying ownership or read access to the referenced files. The system treats meta.knowledge entries of type file as an authorization source, which can be exploited by a malicious model owner to attach another user's file ID to their model metadata. This allows the attacker to read or delete private files belonging to other users.Technical details include:
- API Endpoints:
GET '/api/v1/files/{id}/content'andDELETE '/api/v1/files/{id}'can be used to read or delete unauthorized files. - Vulnerable Parameters: The
meta.knowledgefield within the model metadata is used to inject unauthorized file IDs. - Function Names: The
view file()tool and thehas access to file()function incorrectly trust the forged metadata for authorization.
Recommendations
Update to version 0.9.6.
As a temporary workaround, restrict the
workspace.models and workspace.models import permissions to trusted users only to prevent the creation of malicious models.Exploit
Fix
Missing Authorization
Improper Access Control
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Open-Webui