Authorization Bypass in Open WebUI Knowledge Base

Executive Summary

Open WebUI versions 0.9.6 to 0.11.3 have an authorization flaw where the knowledge base file listing does not validate if a provided directory_id belongs to the requested knowledge base. This allows users with read access to any knowledge base to use a retained foreign directory UUID to access GET /api/v1/knowledge/{id}/files. The response reveals folder names, owner user IDs, and knowledge base IDs of that directory and its ancestors.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Open WebUI version is between 0.9.6 and 0.11.3. Use the endpoint GET /api/v1/knowledge/{id}/files with a foreign directory UUID to see if it returns breadcrumbs with folder names, owner IDs, or knowledge base IDs from other directories.

Useful 0 Not Useful 0

Impact Analysis

An attacker with read access to a knowledge base could exploit this to access unauthorized directories, exposing sensitive folder structures, user IDs, and knowledge base details. This could lead to information leakage or further attacks if combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing sensitive data such as folder names or user IDs without proper authorization. Unauthorized access risks non-compliance with data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later to address the authorization flaw in knowledge base file listing.

Useful 0 Not Useful 0