CVE-2026-70487: Open WebUI Information Disclosure Flaw

CVE-2026-70487 Overview

CVE-2026-70487 is a missing authorization vulnerability [CWE-862] in Open WebUI, a self-hosted AI platform. The flaw affects versions 0.8.8 through releases prior to 0.11.0. Inline direct model metadata accepted client-supplied knowledge attachments without validating them against the caller's read access. Any authenticated user who obtained another user's file identifier could invoke the built-in knowledge tools and receive indexed chunks from that file. The impact is limited to read-only cross-user confidentiality loss. Knowledge-base permissions and saved workspace model validation remained intact. The maintainers fixed the issue in version 0.11.0.

Critical Impact
Authenticated users can read indexed knowledge chunks from files owned by other users by supplying arbitrary file identifiers in direct model metadata.

Affected Products

Open WebUI versions 0.8.8 through releases prior to 0.11.0
Deployments exposing /api/chat/completions with direct model metadata enabled
Multi-tenant Open WebUI instances with per-user knowledge files

Discovery Timeline

2026-08-04 - CVE-2026-70487 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70487

Vulnerability Analysis

Open WebUI supports inline direct model definitions, where a client submits model metadata alongside a chat completion request. That metadata could include a knowledge array referencing files the platform had already indexed. The chat pipeline forwarded these knowledge references to the built-in knowledge tools without confirming that the requesting user held read access to each referenced file. When the tools executed retrieval, they returned indexed chunks regardless of ownership. The result is a cross-tenant confidentiality break confined to file contents indexed for retrieval-augmented generation (RAG).

Root Cause

The root cause is missing authorization on client-supplied knowledge attachments in the direct model path. Server-side code trusted the metadata payload rather than filtering it against the caller's access control list. Knowledge-base level permissions and saved workspace model validation were enforced elsewhere and continued to function. Only the inline direct model route bypassed the check.

Attack Vector

Exploitation requires an authenticated account and knowledge of a target file identifier. The attacker issues a POST request to /api/chat/completions containing a direct model definition whose info.meta.knowledge array references files owned by another user. The knowledge tools then return chunks from those files in the completion output. The attack is network-reachable but requires low privileges and prior knowledge of a valid file ID, limiting opportunistic exploitation.

python

     return await generate_embeddings(request, form_data, user)


+async def _set_direct_model(request: Request, model_item: dict, user) -> None:
+    model_meta = (model_item.get('info') or {}).get('meta') or {}
+    knowledge_items = model_meta.get('knowledge')
+    if knowledge_items:
+        from open_webui.utils.access_control.files import get_accessible_folder_files
+
+        model_meta['knowledge'] = await get_accessible_folder_files(knowledge_items, user)
+    request.state.direct = True
+    request.state.model = model_item
+
+
 @app.post('/api/chat/completions')
 @app.post('/api/v1/chat/completions')  # Experimental: Compatibility with OpenAI API
 async def chat_completion(

Source: GitHub commit 305880f. The patch introduces _set_direct_model, which calls get_accessible_folder_files to filter client-supplied knowledge items against the caller's permissions before the request state is populated.

Detection Methods for CVE-2026-70487

Indicators of Compromise

POST requests to /api/chat/completions or /api/v1/chat/completions containing an inline model object with an info.meta.knowledge array.
Chat completion responses that surface content from file IDs not owned by the requesting user.
Repeated requests from a single account referencing many distinct file identifiers, indicating enumeration.

Detection Strategies

Correlate the requesting user identity with the owner of each knowledge file ID in application logs to flag cross-user references.
Log and inspect the raw JSON body of direct model requests; alert when info.meta.knowledge contains IDs not visible in the user's workspace.
Baseline normal knowledge-file access patterns per user and alert on volume anomalies against /api/chat/completions.

Monitoring Recommendations

Enable verbose application logging on the Open WebUI chat completion endpoints and ship logs to a centralized SIEM.
Track the deployed Open WebUI version and alert when instances run releases from 0.8.8 up to but excluding 0.11.0.
Review audit trails for knowledge tool invocations and reconcile them against file ownership records.

How to Mitigate CVE-2026-70487

Immediate Actions Required

Upgrade all Open WebUI deployments to version 0.11.0 or later, which contains the authorization fix.
Rotate or revoke API tokens for accounts that may have enumerated file identifiers on affected versions.
Audit indexed knowledge files for sensitive content and reassess whether those documents should remain in shared retrieval indexes.

Patch Information

The fix ships in Open WebUI 0.11.0. See the GitHub Release v0.11.0 and the GitHub Security Advisory GHSA-6xhv-rxhv-pwm4. The corrective commit adds _set_direct_model, which filters client-supplied knowledge references through get_accessible_folder_files before the direct model state is applied.

Workarounds

Restrict Open WebUI access to trusted authenticated users until the upgrade to 0.11.0 is complete.
Disable or gate the direct model path via a reverse proxy rule that rejects requests containing info.meta.knowledge payloads.
Segregate sensitive knowledge files into dedicated instances so that a cross-user disclosure cannot span tenants.

bash

# Upgrade Open WebUI container to the fixed release
docker pull ghcr.io/open-webui/open-webui:v0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.0