Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Global Knowledge Base Enumeration via knowledge-bases Meta-Collection Affected ComponentRetrieval collection access validation:- backend/openwebui/routers/retrieval.py lines 2330-2355, validatecollectionaccess- backend/openwebui/routers/retrieval.py query endpoints, e.g. POST /query/doc Affected...

PYSEC-2026-2729 Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Unauthorized File and Knowledge Base Content Access via RAG Vector Search Affected Component RAG source resolution in chat completion pipeline: - backend/openwebui/retrieval/utils.py lines 963-965, 1063-1068, 1126-1131 in getsourcesfromitems Affected Versions Current main branch commit 6fdd19bf1...

Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

SummaryAny authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/id/files an...

PYSEC-2026-2693 Open WebUI has unauthorized deletion of knowledge files

Summary An access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base or is admin, but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from...

Open WebUI has unauthorized deletion of knowledge files

SummaryAn access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base or is admin, but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from...

PYSEC-2026-2742 Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

Summary Any authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/id/files a...

PT-2026-59223

Summary Langflow is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledge bases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this fla...

PT-2026-59364

Summary Open WebUI has a Broken Object Level Authorization BOLA vulnerability in the builtin search knowledge files tool. When native function calling is enabled and the selected model has no attached knowledge bases, an authenticated user can call search knowledge files with an arbitrary knowled...

PT-2026-59337

Summary Any authenticated user can permanently delete files owned by other users via DELETE /api/v1/files/id when the target file is referenced in any shared chat. The has access to file authorization gate unconditionally grants access through its shared-chat branch. It checks neither the...

PT-2026-59354

Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite Affected Component Retrieval web/YouTube processing endpoints: - backend/open webui/routers/retrieval.py lines 1810-1837, process web - backend/open webui/routers/retrieval.py the parallel process youtube endpoint ...

PT-2026-59393

Cross-User File Access via Unchecked file id in Folder Knowledge and Knowledge-Base Attach Endpoints Summary Multiple endpoints accept a user-supplied file id and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the call...

PT-2026-59371

Unauthorized File and Knowledge Base Content Access via RAG Vector Search Affected Component RAG source resolution in chat completion pipeline: - backend/open webui/retrieval/utils.py lines 963-965, 1063-1068, 1126-1131 in get sources from items Affected Versions Current main branch commit...

PT-2026-59338

Summary An access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base or is admin, but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from...

PT-2026-59351

Global Knowledge Base Enumeration via knowledge-bases Meta-Collection Affected Component Retrieval collection access validation: - backend/open webui/routers/retrieval.py lines 2330-2355, validate collection access - backend/open webui/routers/retrieval.py query endpoints, e.g. POST /query/doc...

PT-2026-59344

IDOR: Retrieval API Bypasses Knowledge Base Access Controls Author: Andrew Orr Summary validate collection access PR 22109 checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any authenticated user who...

PT-2026-59534

Summary PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. Details This issue affec...

PT-2026-59384

Summary Any authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/id/files a...

CVE-2026-1832: Missing Authorization

The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability check on the 'thrivedeskclearcache' AJAX action in all versions up to, and including, 2.1.7. This makes it possible for authenticated...

Deloitte AI Assist for Customer multiple vulnerabilities

RISK EVALUATION Deloitte AI Assist for Customer contained multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could read or write data to the RAG corpus or make limited modifications to configurations. 2. RECOMMENDED PRACTICES Use only the most recent available...

CVE-2026-15104: Improper Neutralization of Special Elements used in an SQL Command

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...