{"id":"CVE-2026-109285","kind":"vulnerability","aliases":["CVE-2026-109285","GHSA-9cxp-636w-4997"],"related":[],"title":"Knowledge base collaborators keep read and delete access to removed files via stale file metadata","description":"# Knowledge base collaborators keep read and delete access to removed files via stale file metadata\r\n\r\n## Summary\r\nA user who has been granted access to a shared knowledge base keeps access to a file after the owner removes that file from the knowledge base. With a read grant they can still download the file, and with a write grant they can delete it for everyone, including from other private knowledge bases of the owner that they cannot open. The file access check trusted a knowledge base reference cached on the file record and never confirmed that the file is still attached to that knowledge base.\r\n\r\n## Preconditions\r\n- Default configuration. No setting needs to be changed.\r\n- The attacker is an ordinary user who holds a read grant (to read) or a write grant (to delete) on a knowledge base owned by the victim.\r\n- The file was last processed into that shared knowledge base. If it was processed into another knowledge base afterwards, the cached reference points elsewhere and the issue does not occur.\r\n- The owner removes the file from the shared knowledge base in a way that keeps the file on the instance: the knowledge base sync cleanup when the file is still attached to another knowledge base, or, up to 0.11.0, resetting the knowledge base.\r\n- The attacker knows the file id, which they could see while the file was still shared with them.\r\n\r\n## Impact\r\nAfter the file has been removed from the shared knowledge base, the former collaborator can still download its content and, with a write grant, delete it. Deletion removes the file from every knowledge base that still references it, including the owner's private ones that the attacker never had access to. Exploitation depends on the owner's own actions (processing order and how the file was removed), so an attacker cannot force it. Files that were never shared through a knowledge base, and knowledge bases the attacker was never granted, are not affected.\r\n\r\n## Fix\r\nFixed in PR #29937. Knowledge base access to a file is now derived only from the file's current knowledge base associations, and the cached reference on the file record is no longer consulted. Upgrading is sufficient.\r\n\r\n## Root cause\r\n- Component: `has_access_to_file` in `backend/open_webui/utils/access_control/files.py` (in `backend/open_webui/routers/files.py` before 0.8.6), used by the file content, update, rename and delete endpoints.\r\n- Affected setup: every build from 0.6.0 to 0.11.3.\r\n\r\nWhen a file is processed into a knowledge base, the id of that knowledge base is stored in the file's metadata. The access check granted access to anyone with the matching permission on the knowledge base named there, but it never checked that the file was still attached to it. Removing a file from a knowledge base does not clear that value, so the old knowledge base's grants kept applying to the file after it had been removed.\r\n\r\n## Proof of concept\r\n1. As the owner, create private knowledge bases B and A and upload a text file containing a unique marker.\r\n2. Add the file to B and let it process, then add it to A and let it process.\r\n3. Grant the attacker read and write on A with `POST /api/v1/knowledge/{A}/access/update`.\r\n4. As the owner, remove the file from A with `POST /api/v1/knowledge/{A}/sync/cleanup` and `{\"file_ids\":[\"FILE_ID\"],\"dir_ids\":[]}`. The file remains in B, and the attacker cannot open B.\r\n5. As the attacker, `GET /api/v1/files/FILE_ID/content` returns 200 with the marker.\r\n6. As the attacker, `DELETE /api/v1/files/FILE_ID` returns 200, and the file is removed from B.\r\n7. Control: with processing order A then B, both requests return 404.\r\n\r\nThe reporter reproduced this over HTTP on a running instance. It was independently reproduced on 0.11.3 (sync cleanup) and on 0.6.0 and 0.11.0 (knowledge base reset) against the real routers, with the users, knowledge bases, grants and the cached processing reference seeded directly into the database. On 0.11.4 both requests return 404.\r\n\r\n## Credits\r\n@torjan0 reported the issue and the proof of concept.","summary":"Open WebUI keeps a stale knowledge base reference on a file after it is removed from a shared knowledge base, so former collaborators can still download the file. A collaborator with a write grant can also delete it, including from the owner's private knowledge bases.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"open-webui","fixed":["0.11.4"],"affected":">= 0.6.0, < 0.11.4","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-863","open-webui","python","self-hosted"],"not_affected_if":["auth-required","no-shared-knowledge-bases","version-outside-range"],"how_to_check":"- Check the installed version with `pip show open-webui` or the image tag; affected builds are `0.6.0` up to but not including `0.11.4`.\n- Review which users hold read or write grants on shared knowledge bases, since only former collaborators can exploit this.","fix":"- `open-webui` `0.11.4`","status":"open","published_at":"2026-09-27T19:25:50+00:00","first_seen_at":"2026-11-09T22:53:28+00:00","triaged_at":"2026-11-09T23:01:13+00:00","updated_at":"2026-11-09T23:01:13+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-09T23:01:13Z","model":"claude-haiku-5-5","output":{"fix":"- `open-webui` `0.11.4`","reach":"network","title":"Open WebUI: removed knowledge base files stay readable and deletable by collaborators","impact":"medium","summary":"Open WebUI keeps a stale knowledge base reference on a file after it is removed from a shared knowledge base, so former collaborators can still download the file. A collaborator with a write grant can also delete it, including from the owner's private knowledge bases.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["open-webui","self-hosted","python"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"former collaborator downloads or deletes files from owner's private knowledge bases","analyst_note":"","how_to_check":"- Check the installed version with `pip show open-webui` or the image tag; affected builds are `0.6.0` up to but not including `0.11.4`.\n- Review which users hold read or write grants on shared knowledge bases, since only former collaborators can exploit this.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-shared-knowledge-bases","version-outside-range","auth-required"],"who_is_affected":"Teams that run a self-hosted Open WebUI instance with shared knowledge bases are exposed, because the flaw depends on a file that was once shared and later removed while staying on the instance. Instances that do not share knowledge bases between users, or that run a build outside 0.6.0 to 0.11.3, are not affected. The sources say the bug needs an ordinary user account with a grant, and that the owner's actions trigger it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000878,"input_tokens":5835,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109285':18A,26A '-2026':17A,25A '-863':34B '/access/update':617C '/api/v1/files/file_id':666C '/api/v1/files/file_id/content':655C '/api/v1/knowledge':615C,629C '/sync/cleanup':631C '0.11.0':296C,710C '0.11.3':481C,703C '0.11.4':735C '0.6.0':479C,708C '0.8.6':463C '1':565C '2':585C '200':657C,668C '29937':417C '3':604C '4':618C '404':687C,739C '4997':23A '5':650C '6':661C '636w':22A '7':676C '9cxp':21A 'access':8A,95C,110C,117C,167C,369C,420C,455C,505C,508C 'action':378C 'add':586C,596C 'affect':412C,474C 'afterward':246C 'ai':31B 'ai-tool':30B 'also':77B 'anoth':243C,290C 'anyon':510C 'appli':553C 'associ':435C 'attach':187C,288C,530C 'attack':202C,302C,366C,389C,406C,607C,646C,653C,664C 'b':573C,590C,643C,649C,675C,683C 'backend/open_webui/routers/files.py':461C 'backend/open_webui/utils/access_control/files.py':459C 'base':2A,48B,61B,87B,89C,115C,130C,157C,172C,191C,223C,237C,245C,267C,280C,292C,300C,330C,353C,401C,404C,419C,434C,490C,496C,518C,539C,549C,572C,712C,722C 'build':477C 'cach':174C,248C,438C,726C 'cannot':163C,390C,647C 'caus':452C 'chang':200C 'check':168C,506C,524C 'cleanup':282C,705C 'clear':542C 'collabor':3A,64B,71B,90C,333C 'compon':453C 'concept':564C 'configur':194C 'confirm':181C 'consult':447C 'contain':581C 'content':338C,468C 'control':677C 'could':309C 'creat':569C 'credit':740C 'current':432C 'cve':16A,24A 'cwe':33B 'databas':733C 'default':193C 'delet':7A,78B,94C,148C,219C,344C,346C,472C,665C 'depend':372C 'deriv':426C 'dir':637C 'direct':730C 'download':67B,138C,336C 'elsewher':251C 'endpoint':473C 'everi':351C,476C 'everyon':151C 'exploit':371C 'file':11A,14A,52B,69B,98C,101C,120C,126C,140C,166C,177C,184C,229C,262C,274C,285C,305C,313C,322C,349C,384C,393C,423C,430C,442C,457C,467C,484C,501C,527C,535C,556C,580C,588C,624C,633C,635C,640C,671C 'fix':413C,414C 'forc':391C 'former':63B,332C 'get':654C 'ghsa':20A 'ghsa-9cxp-636w':19A 'grant':75B,109C,134C,145C,211C,217C,343C,409C,507C,551C,605C,723C 'hold':208C 'host':41B 'http':693C 'id':306C,492C,634C,636C,638C 'impact':319C 'includ':80B,152C,358C 'independ':700C 'instanc':277C,697C 'issu':254C 'keep':4A,44B,91C,116C,272C 'kept':552C 'know':303C 'knowledg':1A,47B,60B,86B,88C,114C,129C,156C,171C,190C,222C,236C,244C,266C,279C,291C,299C,329C,352C,400C,403C,418C,433C,489C,495C,517C,538C,548C,571C,711C,721C 'last':231C 'let':592C,601C 'longer':446C 'marker':584C,660C 'match':513C 'metadata':15A,102C,503C 'name':519C 'need':197C 'never':180C,367C,396C,408C,523C 'occur':257C 'old':547C 'one':363C 'open':28A,36B,42B,164C,648C 'open-webui':27A,35B 'order':380C,680C 'ordinari':205C 'own':224C 'owner':83B,123C,160C,259C,360C,375C,568C,621C 'permiss':514C 'point':250C 'post':614C,628C 'pr':416C 'precondit':192C 'privat':85B,155C,362C,570C 'process':232C,241C,379C,486C,594C,603C,679C,727C 'proof':562C 'python':38B 'read':5A,92C,133C,210C,213C,608C 'real':716C 'record':178C,443C 'refer':49B,173C,249C,356C,439C,728C 'remain':641C 'remov':10A,56B,97C,124C,260C,325C,347C,386C,533C,561C,622C,673C 'renam':470C 'report':689C,742C 'reproduc':690C,701C 'request':685C,737C 'reset':297C,713C 'return':656C,667C,686C,738C 'root':451C 'router':717C 'run':696C 'see':310C 'seed':729C 'self':40B 'self-host':39B 'set':196C 'setup':475C 'share':59B,113C,235C,265C,316C,328C,397C 'stale':13A,46B,100C 'still':66B,137C,186C,287C,315C,335C,355C,529C 'store':498C 'suffici':450C 'summari':103C 'sync':281C,704C 'text':579C 'th':743C 'tool':32B 'torjan0':741C 'trust':169C 'uniqu':583C 'updat':469C 'upgrad':448C 'upload':577C 'use':464C 'user':105C,206C,720C 'valu':544C 'via':12A,99C 'victim':227C 'way':270C 'webui':29A,37B,43B 'write':74B,144C,216C,342C,610C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Open WebUI instance with shared knowledge bases are exposed, because the flaw depends on a file that was once shared and later removed while staying on the instance. Instances that do not share knowledge bases between users, or that run a build outside 0.6.0 to 0.11.3, are not affected. The sources say the bug needs an ordinary user account with a grant, and that the owner's actions trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openwebui"],"ptokens":["open","webui"],"labels":["aitooling","cwe863","medium","openwebui","pypi","python","selfhosted"],"campaign_type":null,"search_a":"'-109285':18A,26A '-2026':17A,25A '4997':23A '636w':22A '9cxp':21A 'access':8A 'base':2A 'collabor':3A 'cve':16A,24A 'delet':7A 'file':11A,14A 'ghsa':20A 'ghsa-9cxp-636w':19A 'keep':4A 'knowledg':1A 'metadata':15A 'open':28A 'open-webui':27A 'read':5A 'remov':10A 'stale':13A 'via':12A 'webui':29A","search_b":"'-863':34B 'ai':31B 'ai-tool':30B 'also':77B 'base':48B,61B,87B 'collabor':64B,71B 'cwe':33B 'delet':78B 'download':67B 'file':52B,69B 'former':63B 'grant':75B 'host':41B 'includ':80B 'keep':44B 'knowledg':47B,60B,86B 'open':36B,42B 'open-webui':35B 'owner':83B 'privat':85B 'python':38B 'refer':49B 'remov':56B 'self':40B 'self-host':39B 'share':59B 'stale':46B 'still':66B 'tool':32B 'webui':37B,43B 'write':74B","search_c":"'/access/update':617C '/api/v1/files/file_id':666C '/api/v1/files/file_id/content':655C '/api/v1/knowledge':615C,629C '/sync/cleanup':631C '0.11.0':296C,710C '0.11.3':481C,703C '0.11.4':735C '0.6.0':479C,708C '0.8.6':463C '1':565C '2':585C '200':657C,668C '29937':417C '3':604C '4':618C '404':687C,739C '5':650C '6':661C '7':676C 'access':95C,110C,117C,167C,369C,420C,455C,505C,508C 'action':378C 'add':586C,596C 'affect':412C,474C 'afterward':246C 'anoth':243C,290C 'anyon':510C 'appli':553C 'associ':435C 'attach':187C,288C,530C 'attack':202C,302C,366C,389C,406C,607C,646C,653C,664C 'b':573C,590C,643C,649C,675C,683C 'backend/open_webui/routers/files.py':461C 'backend/open_webui/utils/access_control/files.py':459C 'base':89C,115C,130C,157C,172C,191C,223C,237C,245C,267C,280C,292C,300C,330C,353C,401C,404C,419C,434C,490C,496C,518C,539C,549C,572C,712C,722C 'build':477C 'cach':174C,248C,438C,726C 'cannot':163C,390C,647C 'caus':452C 'chang':200C 'check':168C,506C,524C 'cleanup':282C,705C 'clear':542C 'collabor':90C,333C 'compon':453C 'concept':564C 'configur':194C 'confirm':181C 'consult':447C 'contain':581C 'content':338C,468C 'control':677C 'could':309C 'creat':569C 'credit':740C 'current':432C 'databas':733C 'default':193C 'delet':94C,148C,219C,344C,346C,472C,665C 'depend':372C 'deriv':426C 'dir':637C 'direct':730C 'download':138C,336C 'elsewher':251C 'endpoint':473C 'everi':351C,476C 'everyon':151C 'exploit':371C 'file':98C,101C,120C,126C,140C,166C,177C,184C,229C,262C,274C,285C,305C,313C,322C,349C,384C,393C,423C,430C,442C,457C,467C,484C,501C,527C,535C,556C,580C,588C,624C,633C,635C,640C,671C 'fix':413C,414C 'forc':391C 'former':332C 'get':654C 'grant':109C,134C,145C,211C,217C,343C,409C,507C,551C,605C,723C 'hold':208C 'http':693C 'id':306C,492C,634C,636C,638C 'impact':319C 'includ':152C,358C 'independ':700C 'instanc':277C,697C 'issu':254C 'keep':91C,116C,272C 'kept':552C 'know':303C 'knowledg':88C,114C,129C,156C,171C,190C,222C,236C,244C,266C,279C,291C,299C,329C,352C,400C,403C,418C,433C,489C,495C,517C,538C,548C,571C,711C,721C 'last':231C 'let':592C,601C 'longer':446C 'marker':584C,660C 'match':513C 'metadata':102C,503C 'name':519C 'need':197C 'never':180C,367C,396C,408C,523C 'occur':257C 'old':547C 'one':363C 'open':164C,648C 'order':380C,680C 'ordinari':205C 'own':224C 'owner':123C,160C,259C,360C,375C,568C,621C 'permiss':514C 'point':250C 'post':614C,628C 'pr':416C 'precondit':192C 'privat':155C,362C,570C 'process':232C,241C,379C,486C,594C,603C,679C,727C 'proof':562C 'read':92C,133C,210C,213C,608C 'real':716C 'record':178C,443C 'refer':173C,249C,356C,439C,728C 'remain':641C 'remov':97C,124C,260C,325C,347C,386C,533C,561C,622C,673C 'renam':470C 'report':689C,742C 'reproduc':690C,701C 'request':685C,737C 'reset':297C,713C 'return':656C,667C,686C,738C 'root':451C 'router':717C 'run':696C 'see':310C 'seed':729C 'set':196C 'setup':475C 'share':113C,235C,265C,316C,328C,397C 'stale':100C 'still':137C,186C,287C,315C,335C,355C,529C 'store':498C 'suffici':450C 'summari':103C 'sync':281C,704C 'text':579C 'th':743C 'torjan0':741C 'trust':169C 'uniqu':583C 'updat':469C 'upgrad':448C 'upload':577C 'use':464C 'user':105C,206C,720C 'valu':544C 'via':99C 'victim':227C 'way':270C 'write':144C,216C,342C,610C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-27T19:25:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-9cxp-636w-4997","url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-9cxp-636w-4997","severity":"medium","published_at":"2026-09-27T19:25:50+00:00","modified_at":"2026-10-28T20:46:53+00:00","first_seen_at":"2026-11-09T22:53:28+00:00","fetched_at":"2026-11-09T22:53:28+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-109285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109285","severity":null,"published_at":"2026-10-12T17:17:21+00:00","modified_at":"2026-10-15T15:55:45+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110657,"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-9cxp-636w-4997","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-27T19:25:50+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":111018,"url":"https://www.vulncheck.com/advisories/open-webui-0.6.0-before-0.11.4-improper-access-control-via-stale-file-metadata","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}