CVE-2026-109285

Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

State: Published
Severity: 2.3 Low
Published: Oct 12, 2026
Updated: Oct 23, 2026
Reserved: Oct 12, 2026

Description

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L	VulnCheck

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
open-webuiopen-webui	0.6.0 to before 0.11.4Affected 0.11.4Not affected

References

GitHub Security Advisory (GHSA-9cxp-636w-4997)vendor-advisory
VulnCheck Advisory: Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadatathird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.