CVE-2026-109285
Received Received - Intake

Improper Access Control in Open WebUI Allows File Access Retention

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109285
EUVD
EUVD-2026-97587

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-webui open-webui 0.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open WebUI versions 0.6.0 to 0.11.4 have an improper access control flaw in the has_access_to_file function. This allows former collaborators who had access to knowledge bases to retain file access through outdated cached references. Attackers with prior read or write permissions can exploit this to download or delete files, even from private knowledge bases owned by others.

Detection Guidance

Check Open WebUI version with: docker inspect open-webui | grep -i version. If version is between 0.6.0 and 0.11.3, the system is vulnerable. Review knowledge base collaborators and file access logs for unauthorized file downloads or deletions.

Impact Analysis

If you previously collaborated on knowledge bases in Open WebUI, an attacker could access files you thought were removed. They might steal sensitive data by downloading files or disrupt operations by deleting them. Private files in your knowledge bases could also be compromised.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance breaches, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later. Remove all collaborators from knowledge bases and re-add only necessary users. Audit file access logs for suspicious activity and revoke any unauthorized permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart