Improper Access Control in Open WebUI Affects File Management Functions
CVE-2026-109285

2.3LOW

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109285?

The Open WebUI platform versions 0.6.0 through 0.11.0 exhibit an improper access control flaw concerning the has_access_to_file function. This vulnerability allows users who were previously associated as collaborators to retain access to files even after their permissions have been revoked. Malicious actors with read or write permissions can exploit this issue to download sensitive files that should have been removed or to delete files from private knowledge bases, thereby risking the confidentiality and integrity of information managed through the platform.

Affected Version(s)

open-webui 0.6.0 < 0.11.4

open-webui 0.11.4

References

https://github.com/open-webui/open-webui/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/open-webui-0.6.0-bef...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

torjan0
Classic298
.