CVE-2026-70487

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file id could have the builtin knowledge tools return indexed chunks from that file, causing a read-only cross-user confidentiality loss while leaving knowledge-base permissions and saved workspace model validation unaffected. This issue is fixed in 0.11.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/open-webui/open-webui/commit/305880f2e2aeb2dda2f4b2a18a20bdcd558f7134	Patch
https://github.com/open-webui/open-webui/releases/tag/v0.11.0	Release Notes
https://github.com/open-webui/open-webui/security/advisories/GHSA-6xhv-rxhv-pwm4	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

History

18 Sep 2026, 14:57

Type	Values Removed	Values Added
First Time		Openwebui Openwebui open Webui
CPE		cpe:2.3:a:openwebui:open_webui::::::::
References	~~() https://github.com/open-webui/open-webui/commit/305880f2e2aeb2dda2f4b2a18a20bdcd558f7134 -~~	() https://github.com/open-webui/open-webui/commit/305880f2e2aeb2dda2f4b2a18a20bdcd558f7134 - Patch
References	~~() https://github.com/open-webui/open-webui/releases/tag/v0.11.0 -~~	() https://github.com/open-webui/open-webui/releases/tag/v0.11.0 - Release Notes
References	~~() https://github.com/open-webui/open-webui/security/advisories/GHSA-6xhv-rxhv-pwm4 -~~	() https://github.com/open-webui/open-webui/security/advisories/GHSA-6xhv-rxhv-pwm4 - Patch, Vendor Advisory

Information

Published : 2026-08-04 21:16

Updated : 2026-09-18 14:57

NVD link : CVE-2026-70487

Mitre link : CVE-2026-70487

CVE.ORG link : CVE-2026-70487

JSON object : View

Products Affected

openwebui

open_webui

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-70487", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70487", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T14:46:04.164502Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-webui", "product": "open-webui", "versions": [{"status": "affected", "version": ">= 0.8.8, < 0.11.0"}]}]}], "published": "2026-08-04T21:16:37.480", "references": [{"url": "https://github.com/open-webui/open-webui/commit/305880f2e2aeb2dda2f4b2a18a20bdcd558f7134", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-6xhv-rxhv-pwm4", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file id could have the builtin knowledge tools return indexed chunks from that file, causing a read-only cross-user confidentiality loss while leaving knowledge-base permissions and saved workspace model validation unaffected. This issue is fixed in 0.11.0."}], "lastModified": "2026-09-18T14:57:56.560", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "877048DD-104B-44A2-8BFB-4D2C8B1BFB36", "versionEndExcluding": "0.11.0", "versionStartIncluding": "0.8.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}