PT-2026-50591 · Zilliz+1 · Milvus+1
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Open WebUI versions prior to 0.9.6
Description
An issue exists in the self-hosted artificial intelligence platform where collection-level Access Control List (ACL) checks can be bypassed when Milvus multitenancy mode is enabled. The ACL permits unknown non-Knowledge Base (KB) collection names, treating them as legacy or ephemeral collections. In Milvus multitenancy mode, a user-controlled collection name is used as a
resource id and interpolated into a Milvus expression without proper escaping. This allows an authenticated non-admin user to execute queries that return private knowledge-base chunks belonging to other users.Technical details include:
- API Endpoints: '/api/v1/retrieval/query/collection' and '/api/v1/retrieval/query/doc'
- Vulnerable Parameters:
collection names - Vulnerable Variable:
resource id
Recommendations
Update to version 0.9.6.
As a temporary workaround, restrict access to the '/api/v1/retrieval/query/collection' and '/api/v1/retrieval/query/doc' endpoints or disable Milvus multitenancy mode until the update is applied.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Milvus
Open-Webui