CVE-2026-109285 in Open WebUI
Summary
by MITRE • 10/12/2026
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The identified vulnerability represents a critical failure in access control logic within Open WebUI versions ranging from 0.6.0 up to but not including version 0.11.4. This flaw specifically resides in the has_access_to_file function, which is responsible for verifying whether a user possesses the necessary permissions to interact with specific files stored within knowledge bases. The core technical issue stems from improper handling of cached references associated with these knowledge bases. When users collaborate on a knowledge base, they are granted certain access rights that are typically intended to be revoked upon their removal as collaborators or when the file is deleted by an owner. However, due to stale caching mechanisms, the system fails to invalidate these permissions promptly after such changes occur. Consequently, former collaborators retain effective read and write privileges over files they no longer have legitimate authorization to access.
From a technical perspective, this vulnerability allows attackers who previously held valid credentials with either read or write grants for a specific knowledge base to exploit the lingering cached state. By targeting the file content endpoint, these actors can retrieve sensitive data from documents that were subsequently removed by the owner. Furthermore, the ability to delete files extends beyond simple information disclosure; it enables destructive actions where former collaborators can erase critical assets directly from private knowledge bases owned by other users. This indicates a significant breakdown in the principle of least privilege and proper session or permission state management within the application's backend logic. The persistence of access rights despite explicit revocation suggests that the caching layer does not synchronize effectively with real-time changes to user roles or file ownership status, leading to a race condition-like scenario where outdated permissions are still honored by the system.
The operational impact of this vulnerability is severe, affecting both confidentiality and integrity aspects of data security. For organizations using Open WebUI for sensitive document management, the ability of former team members to access private files poses a substantial risk of intellectual property theft or exposure of confidential business information. Additionally, the capability to delete files from an owner's private knowledge base introduces a denial of service vector that can disrupt workflows and result in permanent data loss if backups are not maintained. This type of vulnerability undermines trust in collaborative platforms where dynamic permission changes are expected to take immediate effect. It also complicates forensic investigations since access logs may show legitimate activity by former users, masking malicious intent behind valid historical credentials.
This flaw aligns with CWE-284 Improper Access Control and specifically relates to issues involving authorization bypass through cached state or session management failures. In the context of the MITRE ATT&CK framework, this vulnerability facilitates unauthorized access to data (T1530) and potentially data destruction (T1485). To mitigate these risks, administrators should immediately upgrade Open WebUI to version 0.11.4 or later where the has_access_to_file logic has been corrected to properly invalidate stale cached references upon permission changes. Until an update is applied, organizations can implement compensating controls such as restricting network access to the application interface and regularly auditing user permissions within knowledge bases to ensure no former collaborators retain active roles. Additionally, maintaining robust backup strategies for private knowledge base contents is essential to recover from potential data deletion attacks exploiting this flaw.