CVE-2026-54012: Open WebUI Auth Bypass Vulnerability

CVE-2026-54012 Overview

CVE-2026-54012 is a broken access control vulnerability [CWE-284] in Open WebUI, a self-hosted artificial intelligence platform. Versions prior to 0.9.6 fail to validate file ownership when users attach meta.knowledge entries to workspace models. An authenticated user who can create, update, or import workspace models can reference arbitrary file IDs belonging to other users. Open WebUI then treats these entries as an authorization source, granting the attacker read and delete access to private files. The vulnerability is patched in version 0.9.6.

Critical Impact
Authenticated users can read and delete other users' private files by attaching arbitrary file IDs to workspace model metadata.

Affected Products

Open WebUI versions prior to 0.9.6
Self-hosted Open WebUI deployments with multi-user workspaces
Installations allowing user-created or imported workspace models

Discovery Timeline

2026-06-23 - CVE-2026-54012 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54012

Vulnerability Analysis

The vulnerability stems from Open WebUI trusting model-owner-supplied metadata as an authorization signal. When a user creates, updates, or imports a workspace model, the application accepts arbitrary meta.knowledge entries without verifying that the submitting user owns or has read access to the referenced file resources.

Open WebUI subsequently consumes these unvalidated metadata entries at two enforcement points. The built-in view_file tool reads extracted text from any file referenced in meta.knowledge. The has_access_to_file() function's model branch authorizes both the file content and file delete endpoints based on the same metadata. This design allows a malicious model owner to escalate metadata into cross-tenant file access.

Root Cause

The root cause is a missing ownership check between the workspace model metadata writer and the referenced file resources. The application conflates "file ID is listed in a model the user owns" with "user has access to the file." No server-side validation confirms that the requesting user originally owns or shares access to the file ID being attached.

Attack Vector

An authenticated attacker enumerates or guesses victim file IDs, then creates or updates a workspace model with a meta.knowledge entry of type file referencing the victim's file ID. Invoking the view_file tool against that model returns the extracted file content. Calling the file delete endpoint through the model branch of has_access_to_file() removes the victim's file. Attack complexity is elevated because the attacker needs valid file identifiers and workspace model permissions.

No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-vjqm-6gcc-62cr for vendor-confirmed details.

Detection Methods for CVE-2026-54012

Indicators of Compromise

Workspace model meta.knowledge entries referencing file IDs not owned by the model creator
Unexpected calls to the view_file tool returning content from files owned by other users
Audit log entries showing file delete operations originating through model-context authorization rather than direct file-owner actions
Sudden disappearance of user-owned files without corresponding owner-initiated delete requests

Detection Strategies

Audit the Open WebUI database for meta.knowledge records where the referenced file's user_id differs from the parent model's user_id
Correlate file read and delete API calls with the authenticated session's owned file inventory to detect cross-user access
Alert on workspace model create or update requests that embed file IDs not previously associated with the requesting user

Monitoring Recommendations

Enable verbose application logging for view_file tool invocations and file delete endpoints
Forward Open WebUI logs to a centralized SIEM for retention and correlation across user sessions
Track anomalous spikes in workspace model imports, which can carry crafted meta.knowledge payloads

How to Mitigate CVE-2026-54012

Immediate Actions Required

Upgrade Open WebUI to version 0.9.6 or later without delay
Review existing workspace models for meta.knowledge entries referencing files owned by other users and remove them
Rotate or re-verify access controls on any files previously stored in multi-user Open WebUI instances
Restrict workspace model creation, update, and import permissions to trusted users until patching is complete

Patch Information

The vulnerability is fixed in Open WebUI 0.9.6. The patch adds ownership validation so that meta.knowledge file entries can no longer be used as an authorization source for files the model owner does not control. Refer to the Open WebUI Security Advisory GHSA-vjqm-6gcc-62cr for full release notes.

Workarounds

Disable user-facing workspace model creation, update, and import functionality until the upgrade is applied
Limit Open WebUI to single-tenant or trusted-user deployments where cross-user file access risk is acceptable
Periodically audit and prune meta.knowledge references against file ownership records as a compensating control

bash

# Configuration example: pin Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.9.6
docker stop open-webui && docker rm open-webui
docker run -d \
  --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.9.6