CVE-2026-109285

MEDIUMCVSS 5.0

Description

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.

Timeline

Published:October 12th, 2026 5:17 PM

Last modified:October 15th, 2026 3:55 PM

CVSS Scoring

CVSS v3: 5.0 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-863

References & Reports

Advisories, patches, and third-party reports

https://github.com/open-webui/open-webui/security/advisories/GHSA-9cxp-636w-4997
https://www.vulncheck.com/advisories/open-webui-0.6.0-before-0.11.4-improper-access-control-via-stale-file-metadata
https://github.com/open-webui/open-webui/security/advisories/GHSA-9cxp-636w-4997

Source: NIST NVD · Data may lag official sources by up to one minute