6 matches found
CVE-2026-109285
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...
EUVD-2026-97587
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...
CVE-2026-109285
Open WebUI versions 0.6.0 before 0.11.4 are vulnerable to an improper access control flaw within the has_access_to_file function. The root cause is the retention of stale cached knowledge base references , which allows former collaborators to maintain unauthorized access to files. An attacker wit...
CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...
CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...
CVE-2026-54012: Improper Access Control
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the...