CVE-2026-109285: Open WebUI Auth Bypass Vulnerability

CVE-2026-109285 Overview

CVE-2026-109285 is an improper access control vulnerability in Open WebUI versions 0.6.0 through versions prior to 0.11.4. The flaw resides in the has_access_to_file function, which relies on stale cached knowledge base references when validating file access. Former collaborators on a knowledge base retain the ability to download or delete files after their access should have been revoked. The issue is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Attackers with prior read or write grants can download removed files through the file content endpoint or delete files from the owner's private knowledge bases.

Affected Products

Open WebUI version 0.6.0
Open WebUI versions after 0.6.0 and before 0.11.4
Open WebUI knowledge base and file content endpoints

Discovery Timeline

2026-10-12 - CVE-2026-109285 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109285

Vulnerability Analysis

Open WebUI is a self-hosted web interface for large language model (LLM) workflows that supports shared knowledge bases. Collaborators can be granted read or write access to a knowledge base and its underlying files. The access decision for file operations flows through the has_access_to_file helper, which consults cached knowledge base references rather than reconciling live membership. When a collaborator is removed, cached references continue to associate the user's identity with the file, so authorization checks succeed against stale data. The result is a persistent authorization gap for any user who previously held read or write grants on the knowledge base.

Root Cause

The root cause is an [CWE-863] incorrect authorization condition in has_access_to_file. The function trusts cached knowledge base metadata to determine whether a requesting user still has access to a file. Removing a collaborator from the knowledge base updates membership, but it does not invalidate the cached references that bind that collaborator to the files. Subsequent authorization lookups return a positive result based on outdated state.

Attack Vector

Exploitation requires network access to the Open WebUI instance and prior low-privilege collaborator rights on the targeted knowledge base. After the owner removes the attacker from the knowledge base, the attacker calls the file content endpoint using the known file identifier to download the file. The attacker can also issue a delete request against the same identifier. Because the stale cache spans the owner's private knowledge bases, these actions can affect data the attacker was never explicitly granted. Full technical details are documented in the GitHub Security Advisory GHSA-9cxp-636w-4997 and the VulnCheck Advisory for Open WebUI.

Detection Methods for CVE-2026-109285

Indicators of Compromise

File content endpoint requests from user accounts that are no longer listed as members of the referenced knowledge base.
Successful HTTP 200 responses on file download or delete routes immediately following a collaborator removal event.
Delete operations against files inside knowledge bases marked private to another user.

Detection Strategies

Correlate audit logs for knowledge base membership changes with subsequent file access by the removed account.
Review application logs for calls to has_access_to_file that return access allowed for users not present in current membership tables.
Flag download or delete requests on knowledge base files where the acting user is not the owner and is absent from live collaborator lists.

Monitoring Recommendations

Enable verbose authorization logging on the Open WebUI backend, especially around file and knowledge base routes.
Forward Open WebUI application logs to a centralized log platform and alert on authorization anomalies.
Track knowledge base membership deltas and generate alerts when removed users continue to access related file identifiers.

How to Mitigate CVE-2026-109285

Immediate Actions Required

Upgrade Open WebUI to version 0.11.4 or later, which corrects the authorization logic in has_access_to_file.
Audit knowledge base membership and remove accounts that no longer require collaborator access.
Review access logs since the first deployment of a version in the 0.6.0 to 0.11.3 range for signs of unauthorized file access.

Patch Information

The maintainers resolved the issue in Open WebUI 0.11.4. The fix invalidates cached knowledge base references on membership change so that subsequent authorization checks reflect live state. Release details and the full advisory are available in the GitHub Security Advisory GHSA-9cxp-636w-4997.

Workarounds

Restrict Open WebUI network exposure to trusted users while planning the upgrade to 0.11.4.
Avoid sharing knowledge bases that contain sensitive files until the patched version is in place.
Rotate or remove sensitive files from previously shared knowledge bases if removed collaborators may have retained access.

bash

# Configuration example: upgrade Open WebUI container to a patched release
docker pull ghcr.io/open-webui/open-webui:0.11.4
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.11.4