CVE-2026-44560: Open WebUI Auth Bypass Vulnerability

CVE-2026-44560 Overview

CVE-2026-44560 is a missing authorization vulnerability [CWE-862] in Open WebUI, a self-hosted artificial intelligence platform designed to run entirely offline. The flaw exists in the get_sources_from_items function, which performs vector store queries without verifying user permissions. Affected code paths include type: "file" requests (non-full-context), type: "text" requests with collection_name, and bare collection_name or collection_names parameters. Authenticated users can query collections and files belonging to other users, extracting content from knowledge bases they should not access. The issue is fixed in Open WebUI 0.9.0.

Critical Impact
Authenticated attackers can read sensitive content from files and knowledge bases owned by other users, exposing proprietary documents and embedded data indexed in the vector store.

Affected Products

Open WebUI versions prior to 0.9.0
Self-hosted Open WebUI deployments using vector store collections
Open WebUI instances exposing the chat completions API to multiple users

Discovery Timeline

2026-05-15 - CVE-2026-44560 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-44560

Vulnerability Analysis

The vulnerability resides in get_sources_from_items, a server-side function that retrieves context from the Open WebUI vector store during retrieval-augmented generation (RAG). The function accepts several input shapes: file references, text references tied to a collection_name, and bare collection_name or collection_names parameters. For these code paths, the function queries the vector store directly without checking whether the requesting user owns or is shared on the referenced collection.

Because Open WebUI stores knowledge bases, uploaded files, and chat-derived embeddings in shared backend collections, any authenticated user who can name or guess a collection identifier can pull back its contents. This breaks tenant isolation between users on the same instance and exposes documents intended to remain private. The attack requires only valid account credentials and network access to the application.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in the source-resolution layer. Authentication is verified at the API boundary, but the downstream RAG path trusts user-supplied collection identifiers without consulting the access control model used elsewhere in Open WebUI. The full-context branch applies appropriate checks, while the non-full-context and direct collection branches do not.

Attack Vector

An attacker authenticates to the Open WebUI instance with any low-privileged account. The attacker then issues a chat or retrieval request that supplies a collection_name, collection_names, or file reference belonging to another user. The server returns matching vector store chunks, which are surfaced as model context or as cited sources. By iterating known or enumerated collection identifiers, the attacker harvests content across the multi-tenant deployment without triggering ownership errors.

No verified public exploit code is available for CVE-2026-44560. See the GitHub Security Advisory GHSA-h36f-rqpx-j5wx for vendor technical details.

Detection Methods for CVE-2026-44560

Indicators of Compromise

Chat completion or retrieval requests containing collection_name or collection_names values that do not correspond to the requesting user's owned or shared collections.
Unexpected user accounts appearing in audit logs as accessing files, knowledge bases, or vector store collections they did not create.
Bursts of API calls iterating sequential or enumerated collection identifiers from a single account.

Detection Strategies

Inspect Open WebUI application logs for requests to get_sources_from_items code paths that reference collection identifiers outside the caller's ownership scope.
Correlate vector store query volume per user against historical baselines to surface anomalous data pulls.
Review reverse proxy or web application firewall logs for repeated POST bodies containing collection_name/collection_names keys from non-administrative users.

Monitoring Recommendations

Enable verbose logging on RAG retrieval calls and forward events to a centralized SIEM for retention and correlation.
Alert on any user account that queries more than a defined threshold of distinct collections within a short window.
Track changes to the open-webui container image digest and version string to confirm patched builds are running.

How to Mitigate CVE-2026-44560

Immediate Actions Required

Upgrade Open WebUI to version 0.9.0 or later, which adds authorization checks to all get_sources_from_items paths.
Audit existing knowledge bases and uploaded files for sensitive content and rotate or remove documents that may have been exposed.
Restrict account creation and review the active user roster on shared Open WebUI deployments.

Patch Information

The Open WebUI maintainers fixed the issue in release 0.9.0. The vendor advisory is published as GHSA-h36f-rqpx-j5wx. Operators should pull the updated container image or Python package and redeploy. Confirm the running version through the administrative settings page or by inspecting the package metadata.

Workarounds

If immediate patching is not possible, place Open WebUI behind an authenticating reverse proxy that limits access to trusted users only.
Disable shared knowledge base features and remove non-essential collections until the upgrade is applied.
Convert multi-tenant deployments to single-user instances per trust boundary as an interim isolation measure.

bash

# Upgrade Open WebUI container to the fixed release
docker pull ghcr.io/open-webui/open-webui:0.9.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.9.0

# Verify the running version
docker exec open-webui cat /app/backend/open_webui/env.py | grep VERSION