CVE-2026-109287 in Open WebUI
Summary
by MITRE • 10/12/2026
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Open WebUI versions prior to 0.11.4 represents a critical authorization bypass rooted in improper access control mechanisms within the application's file management subsystem. Specifically, the flaw resides in the endpoint responsible for listing files associated with a knowledge base, which fails to validate that the directory identifier provided by the client actually belongs to the target knowledge base context. This architectural oversight allows an authenticated user who possesses read permissions for any single knowledge base to manipulate request parameters and access file listings from directories belonging to entirely different knowledge bases or even other users' private data stores. By supplying a retained foreign directory UUID, attackers can bypass intended isolation boundaries that are supposed to segregate data based on ownership and organizational structure within the platform.
From a technical perspective, this issue is classified under CWE-284 Improper Access Control, as the application fails to enforce proper restrictions on unauthorized access attempts. The vulnerability enables an attacker with minimal privileges to enumerate sensitive metadata associated with directories outside their authorized scope. When exploiting this flaw via a GET request to the /api/v1/knowledge/{id}/files endpoint, the server returns breadcrumb information that includes folder names, owner user IDs, and knowledge base identifiers for the specified directory and all its ancestral paths. This leakage of structural and ownership metadata is particularly dangerous because it provides attackers with valuable intelligence about the internal organization of data repositories, potentially facilitating further targeted attacks such as privilege escalation or more precise exploitation of other vulnerabilities within specific high-value directories.
The operational impact of this vulnerability extends beyond simple information disclosure. By exposing owner user IDs and knowledge base identifiers, an attacker can map out the relationships between different users and their respective data silos. This contextual awareness lowers the barrier for subsequent attacks, as it allows adversaries to identify high-profile targets or sensitive projects that may have weaker security postures elsewhere in the system. Furthermore, the exposure of folder names might reveal proprietary project titles or internal naming conventions, which can be leveraged for social engineering campaigns or to tailor phishing efforts against specific individuals identified through the leaked owner IDs. In environments where knowledge bases contain confidential documents, this lack of isolation could lead to significant data leakage if combined with other vulnerabilities that allow actual file content retrieval.
To mitigate this risk, immediate action is required by upgrading Open WebUI to version 0.11.4 or later, where the authorization logic has been corrected to strictly verify directory ownership against the requesting user's permissions and knowledge base context. In addition to patching, organizations should implement strict input validation on all API endpoints that handle resource identifiers, ensuring that every request is cross-referenced with access control lists before processing. Security teams should also audit existing deployments for signs of exploitation by monitoring logs for unusual patterns in file listing requests, particularly those involving directory IDs that do not correspond to the user's known assets. Aligning future development practices with ATT&CK techniques related to Discovery and Collection will help prevent similar architectural flaws from being introduced into the codebase.