Authorization Flaw in Open WebUI Affects User Data Exposure

CVE-2026-109287

What is CVE-2026-109287?

The Open WebUI has a vulnerability that allows unauthorized users to exploit an authorization flaw involving knowledge base file listings. This issue arises because the application does not verify whether the supplied directory ID corresponds to the requested knowledge base. Users who have read access to any knowledge base can leverage this flaw to access sensitive information by supplying a foreign directory UUID. When making a GET request to the API endpoint /api/v1/knowledge/{id}/files, the application returns breadcrumbs that reveal folder names, owner user IDs, and knowledge base IDs of both the specified directory and its ancestral directories, leading to potential information exposure.

References