Improper Access Control in Open WebUI Affects User Knowledge Bases

CVE-2026-45398

What is CVE-2026-45398?

The Open WebUI platform, designed for offline artificial intelligence operations, contains a vulnerability that allows authenticated users to access private knowledge bases if they possess the UUID of the collection. The affected method, _validate_collection_access(), inadequately checks user permissions for knowledge base collections, enabling unauthorized access to sensitive information. Additionally, this flaw permits attackers to inject or overwrite contents in a user's knowledge base through various retrieval query endpoints. This issue has been addressed in Open WebUI version 0.9.5.

References