CVE-2026-45398

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45398", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-12T01:48:40.451Z", "datePublished": "2026-05-15T20:35:35.482Z", "dateUpdated": "2026-05-19T03:55:35.975Z"}, "containers": {"cna": {"title": "Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-4g37-7p2c-38r9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-4g37-7p2c-38r9"}, {"name": "https://github.com/open-webui/open-webui/pull/22109", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-webui/open-webui/pull/22109"}, {"name": "https://github.com/open-webui/open-webui/releases/tag/v0.9.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-webui/open-webui/releases/tag/v0.9.5"}], "affected": [{"vendor": "open-webui", "product": "open-webui", "versions": [{"version": "< 0.9.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T20:35:35.482Z"}, "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, _validate_collection_access() checks the user-memory-* and file-* collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any authenticated user who knows a private knowledge base UUID can read its content through the retrieval query endpoints, even though the knowledge API correctly denies that user access. The same gap affects the retrieval write endpoints (/process/text, /process/file, /process/files/batch, /process/web, /process/youtube), allowing an attacker to inject content into or overwrite another user's knowledge base. This vulnerability is fixed in 0.9.5."}], "source": {"advisory": "GHSA-4g37-7p2c-38r9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-4g37-7p2c-38r9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-18T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-45398"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T03:55:35.975Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45398", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-18T16:01:45.264814Z"}}}], "references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-4g37-7p2c-38r9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T16:01:27.587Z"}}], "cna": {"title": "Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls", "source": {"advisory": "GHSA-4g37-7p2c-38r9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "open-webui", "product": "open-webui", "versions": [{"status": "affected", "version": "< 0.9.5"}]}], "references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-4g37-7p2c-38r9", "name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-4g37-7p2c-38r9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/open-webui/open-webui/pull/22109", "name": "https://github.com/open-webui/open-webui/pull/22109", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/open-webui/open-webui/releases/tag/v0.9.5", "name": "https://github.com/open-webui/open-webui/releases/tag/v0.9.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, _validate_collection_access() checks the user-memory-* and file-* collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any authenticated user who knows a private knowledge base UUID can read its content through the retrieval query endpoints, even though the knowledge API correctly denies that user access. The same gap affects the retrieval write endpoints (/process/text, /process/file, /process/files/batch, /process/web, /process/youtube), allowing an attacker to inject content into or overwrite another user's knowledge base. This vulnerability is fixed in 0.9.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T20:35:35.482Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45398", "state": "PUBLISHED", "dateUpdated": "2026-05-19T03:55:35.975Z", "dateReserved": "2026-05-12T01:48:40.451Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-15T20:35:35.482Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "open-webui", "vendor": "open-webui", "versions": [{"status": "affected", "version": "< 0.9.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*", "matchCriteriaId": "19F64B41-71DA-4E31-A040-1C351A537567", "versionEndExcluding": "0.9.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, _validate_collection_access() checks the user-memory-* and file-* collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any authenticated user who knows a private knowledge base UUID can read its content through the retrieval query endpoints, even though the knowledge API correctly denies that user access. The same gap affects the retrieval write endpoints (/process/text, /process/file, /process/files/batch, /process/web, /process/youtube), allowing an attacker to inject content into or overwrite another user's knowledge base. This vulnerability is fixed in 0.9.5."}, {"lang": "es", "value": "Open WebUI es una plataforma de inteligencia artificial autoalojada dise\u00f1ada para operar completamente sin conexi\u00f3n. Antes de la versi\u00f3n 0.9.5, _validate_collection_access() verifica los prefijos de nombres de colecci\u00f3n \u2019user-memory-*\u2019 y \u2019file-*\u2019 pero no verifica las colecciones de bases de conocimiento, que utilizan UUIDs sin procesar como nombres de colecci\u00f3n. Cualquier usuario autenticado que conozca un UUID de una base de conocimiento privada puede leer su contenido a trav\u00e9s de los puntos finales de consulta de recuperaci\u00f3n, aunque la API de conocimiento deniega correctamente el acceso a ese usuario. La misma brecha afecta a los puntos finales de escritura de recuperaci\u00f3n (/process/text, /process/file, /process/files/batch, /process/web, /process/youtube), permitiendo a un atacante inyectar contenido o sobrescribir la base de conocimiento de otro usuario. Esta vulnerabilidad se corrige en la versi\u00f3n 0.9.5."}], "id": "CVE-2026-45398", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45398", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-18T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-15T21:16:37.863", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/open-webui/open-webui/pull/22109"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/open-webui/open-webui/releases/tag/v0.9.5"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-4g37-7p2c-38r9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-4g37-7p2c-38r9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "open-webui", "source": "cna", "vendor": "open-webui"}, "product": "open-webui", "vendor": "open-webui"}], "created": "2026-05-15T22:30:06.084451+00:00", "updated": "2026-05-15T23:00:14.676168+00:00", "vendors": ["open-webui", "open-webui$PRODUCT$open-webui"]}