CVE-2026-109285

MEDIUM 5.0

Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

CVSS Score

5.0

EPSS Score

0.0%

EPSS Percentile

0th

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.

CWE	CWE-863
Vendor	open-webui
Product	open-webui
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for open-webui open-webui

Be the first to know when new medium vulnerabilities affecting open-webui open-webui are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

open-webui / open-webui

0.6.0 < 0.11.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/open-webui/open-webui/security/advisories/GHSA-9cxp-636w-4997 vulncheck.com: https://www.vulncheck.com/advisories/open-webui-0.6.0-before-0.11.4-improper-access-control-via-stale-file-metadata

Credits

🔍 torjan0 Classic298