PYSEC-2026-2753 Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

🗓️ 13 Jul 2026 15:19:05Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Missing permission checks in all files endpoints allow authenticated users to list, access, or delete any uploaded file.

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2026-45301	15 May 202621:19	–	attackerkb
BDU FSTEC	The vulnerability of the Open WebUI web interface, based on artificial intelligence, arises from deficiencies in access control. This allows attackers to gain read, modify, and delete access to data.	22 May 202600:00	–	bdu_fstec
Circl	CVE-2026-45301	8 May 202620:57	–	circl
CNNVD	Open WebUI 访问控制错误漏洞	15 May 202600:00	–	cnnvd
CVE	CVE-2026-45301	15 May 202621:19	–	cve
Cvelist	CVE-2026-45301 Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file	15 May 202621:19	–	cvelist
EUVD	EUVD-2026-30653	15 May 202621:19	–	euvd
Github Security Blog	Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file	14 May 202620:15	–	github
NVD	CVE-2026-45301	15 May 202622:16	–	nvd
OSV	CVE-2026-45301 Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file	15 May 202621:19	–	osv

Source	Link
github	www.github.com/open-webui/open-webui/security/advisories/GHSA-r8wh-8m7r-fh33
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45301
github	www.github.com/open-webui/open-webui
pypi	www.pypi.org/project/open-webui
github	www.github.com/advisories/GHSA-r8wh-8m7r-fh33

13 Jul 2026 16:32Current

7High risk

Vulners AI Score7

CVSS 3.18.1

EPSS0.00273