CVE-2026-109287 — Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested kn…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.
Source: CVE Program · Revision 2bc2f154a9513fd639cf69e09a5cddfaedf57bdc