CVE-2026-70493

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

CVE-2026-70493

Open WebUI vulnerability CVE-2026-70493 affects the knowledge search path in backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py for builds from 0.9.6 to 0.11.0. A chat participant can supply a pattern containing regex metacharacters; these patterns were compiled with...

CVE-2026-70493 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

CVE-2026-70493 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

GHSA-6XHV-RXHV-PWM4 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization via the chat completion, chat completed, and chat action endpoints when an inline model definition is used with attached knowledge metadata. An attacker can access the indexed content of...

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

GHSA-JXC9-XMC4-GR23 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the syncknowledgecleanup handler in the backend, which processes directory and file IDs from the request body without verifying their association with the specified knowledge...

CVE-2026-70488 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

CVE-2026-70488

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

EUVD-2026-52899

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

CVE-2026-70488

CVE-2026-70488 – Open WebUI : In Open WebUI builds from 0.9.6 to 0.11.0, the sync cleanup endpoint (POST /api/v1/knowledge/{id}/sync/cleanup) did not properly constrain actions to the target knowledge base. The handler authenticated write access via the URL knowledge base, then acted on directory...

CVE-2026-70488 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

CVE-2026-70488 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

CVE-2026-70487 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file i...

CVE-2026-70487

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file i...

EUVD-2026-52897

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file i...

CVE-2026-70487

Open WebUI (versions 0.8.8–0.11.0) allowed client-supplied knowledge attachments in an inline model to bypass read access checks, enabling any authenticated user who knows another user’s file id to retrieve indexed chunks from that file via builtin knowledge tools. This caused read-only cross-use...