CVE-2026-45301: Open WebUI Auth Bypass Vulnerability

CVE-2026-45301 Overview

CVE-2026-45301 is a broken access control vulnerability [CWE-284] in Open WebUI, a self-hosted artificial intelligence platform built to run entirely offline. Versions prior to 0.3.16 ship file-related API endpoints that lack permission enforcement. Any authenticated user can list, read, and delete files uploaded by any other user on the platform. The vendor resolved the issue in version 0.3.16. The flaw exposes confidential prompts, documents, and AI training data shared across tenants of the same instance.

Critical Impact
Authenticated users can enumerate, exfiltrate, and destroy every file uploaded by every other user on a vulnerable Open WebUI deployment.

Affected Products

Open WebUI versions prior to 0.3.16
Self-hosted Open WebUI deployments serving multiple authenticated users
Open WebUI instances exposing file management API endpoints

Discovery Timeline

2026-05-15 - CVE-2026-45301 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45301

Vulnerability Analysis

The vulnerability resides in the file-related REST API endpoints of Open WebUI. These endpoints handle file listing, retrieval, and deletion operations, but they do not validate that the requesting user owns the target resource. Authentication confirms identity, yet no authorization layer checks resource ownership before serving the request.

An attacker with any valid account on the platform can iterate through file identifiers and pull contents belonging to other users. The same endpoints accept delete operations against arbitrary file IDs, giving low-privileged accounts the ability to destroy data uploaded by administrators or other tenants. The exposure covers both confidentiality and integrity, but the platform itself remains available.

Open WebUI is frequently deployed as a shared front end for local large language models. Uploaded files often include source code, business documents, and sensitive prompts used for retrieval-augmented generation. Cross-user access to this data represents a direct data leakage path.

Root Cause

The root cause is missing authorization checks in the request handlers for file operations. The handlers verify session authentication but do not compare the file owner against the authenticated user before returning or modifying data. This pattern maps to CWE-284, Improper Access Control.

Attack Vector

Exploitation requires network access to the Open WebUI API and a valid low-privilege account. The attacker enumerates file identifiers, then issues GET requests against file retrieval endpoints to harvest contents and DELETE requests to remove files belonging to other accounts. No user interaction is required from the victim.

No public proof-of-concept code or exploit modules are available. The mechanism is described in the GitHub Security Advisory GHSA-r8wh-8m7r-fh33.

Detection Methods for CVE-2026-45301

Indicators of Compromise

Unexpected GET or DELETE requests against /api/v1/files/ endpoints from accounts that did not originally upload the referenced files
Sequential or enumerated file ID access patterns from a single user session
Sudden gaps in user file inventories or user reports of missing uploads
Application logs showing successful file API responses to non-owner principals

Detection Strategies

Audit Open WebUI application logs for file API access where the requesting user differs from the file owner recorded in the database
Correlate authentication events with file access volume to surface accounts pulling disproportionate numbers of files
Flag any account performing file delete operations outside of its own upload history

Monitoring Recommendations

Forward Open WebUI access logs and reverse proxy logs to a centralized logging platform for longitudinal analysis
Set baselines for normal file API request volumes per user and alert on deviations
Monitor egress traffic from the Open WebUI host for large outbound transfers correlated with file retrieval activity

How to Mitigate CVE-2026-45301

Immediate Actions Required

Upgrade Open WebUI to version 0.3.16 or later on all instances
Rotate any secrets, API tokens, or credentials that may have been uploaded as files to a vulnerable deployment
Review file access logs for unauthorized retrieval prior to patching and notify affected users
Restrict registration of new accounts until the upgrade is complete

Patch Information

The vendor fixed CVE-2026-45301 in Open WebUI version 0.3.16. The patch introduces ownership checks on the file-related API endpoints so that authenticated users can only operate on their own files. Refer to the Open Web UI GitHub Security Advisory for the official advisory.

Workarounds

Limit Open WebUI access to a single trusted user until the upgrade is applied
Place the application behind a reverse proxy that enforces per-user path restrictions where feasible
Disable file upload functionality if multi-user operation must continue without patching
Network-isolate the deployment so only vetted administrators can authenticate during the remediation window

bash

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.3.16
docker stop open-webui
docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.3.16