What’s Vulnerable › Vulnerabilities

CVE-2026-109285: Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-15
• Weakness: CWE-863

Description

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.

Affected products

• open-webui: from 0.6.0 before 0.11.4 — fixed in 0.11.4

How to fix

Upgrade to a fixed version: open-webui 0.11.4. Check the vendor advisory for mitigations.

References

• https://github.com/open-webui/open-webui/security/advisories/GHSA-9cxp-636w-4997
• https://www.vulncheck.com/advisories/open-webui-0.6.0-before-0.11.4-improper-access-control-via-stale-file-metadata
• https://github.com/open-webui/open-webui/security/advisories/GHSA-9cxp-636w-4997

Get alerted when CVE-2026-109285 or the next vulnerability affects your stack