Executive Summary

CVE-2026-54012 is a vulnerability in Open WebUI versions 0.9.5 and earlier that allows an authenticated attacker with workspace.model or workspace.model_import permissions to forge model metadata to gain unauthorized access to other users' files.

The flaw arises because Open WebUI does not properly validate the meta.knowledge field when creating, updating, or importing models. An attacker can attach another user's file ID to their model's meta.knowledge, which Open WebUI then trusts as an authorization source.

This allows the attacker to bypass file access controls and use tools like the built-in view_file or file API endpoints to read or delete files belonging to other users.

The vulnerability is fixed in version 0.9.6 by validating meta.knowledge entries to ensure file ownership or proper access permissions before storing them.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated attacker to gain unauthorized access to other users' private files by forging model metadata, which can lead to unauthorized reading and deletion of sensitive data.

Such unauthorized access and potential data modification can result in violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls over personal and sensitive information to ensure confidentiality, integrity, and proper authorization.

Therefore, exploitation of this vulnerability could compromise compliance with these regulations by exposing or altering protected data without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access and modification of private files belonging to other users.

• An attacker with certain permissions can read sensitive file contents they should not have access to.
• An attacker can delete files owned by other users, potentially causing data loss.

Overall, it compromises confidentiality, integrity, and availability of user files within the Open WebUI platform.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if Open WebUI versions 0.9.5 or earlier are in use and if any models have been created, updated, or imported with forged meta.knowledge entries referencing other users' file IDs.

Specifically, monitoring or auditing model metadata for suspicious meta.knowledge entries that reference file IDs not owned or accessible by the model owner can indicate exploitation attempts.

Since the vulnerability requires authenticated access with workspace.model or workspace.model_import permissions, reviewing logs for unusual model creation or update activities by users with these permissions may help detect exploitation.

No explicit commands are provided in the available resources, but general approaches include querying the Open WebUI database or API for models with meta.knowledge entries containing file IDs belonging to other users.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Open WebUI to version 0.9.6 or later, where the vulnerability is fixed by validating meta.knowledge entries during model write operations to ensure proper file ownership or access permissions.

Until the upgrade can be applied, restrict or closely monitor users with workspace.model or workspace.model_import permissions to prevent unauthorized model metadata manipulation.

Additionally, audit existing models for suspicious meta.knowledge entries referencing files not owned by the model owner and remove or correct such entries.

Useful 0 Not Useful 0