CVE-2026-45398: high-severity vulnerability in open-webui
Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.3%
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, _validate_collection_access() checks the user-memory-* and file-* collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any authenticated user who knows a private knowledge base UUID can read its content through the retrieval query endpoints, even though the knowledge API correctly denies that user access. The same gap affects the retrieval write endpoints (/process/text, /process/file, /process/files/batch, /process/web, /process/youtube), allowing an attacker to inject content into or overwrite another user's knowledge base. This vulnerability is fixed in 0.9.5.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
open-webui · open-webuiRelated CVEs — open-webui
In the same product, most dangerous first.
CVE-2025-64496HIGHOpen WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE EventsEPSS 7.2%CVE-2026-34222HIGHOpen WebUI has Broken Access Control in Tool ValvesEPSS 5.1%CVE-2025-65958HIGHOpen WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/webEPSS 4.4%CVE-2026-28788HIGHOpen WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwriteEPSS 3.0%CVE-2026-44551CRITICALOpen WebUI: LDAP Empty Password Authentication BypassEPSS 1.5%CVE-2026-45397MEDIUMOpen WebUI: Unauthenticated RAG Configuration DisclosureEPSS 0.8%