CVE-2026-54009: Open WebUI File Disclosure via Authorization Bypass

Technical summary

CVE-2026-54009 is an authorization bypass (CWE-639) in Open WebUI's POST /api/chat/completions endpoint. The vulnerability occurs in image URL processing: when image_url.url values do not begin with http://, https://, or data:image/ schemes, the system treats them as file identifiers and resolves them against a global file lookup table without performing ownership verification. An authenticated user with knowledge of another user's file ID can construct a chat completion request that causes the server to retrieve, base64-encode, and inject that file as a data URI into the LLM context. The user can then prompt the model to extract, describe, or OCR the content, bypassing file-level access controls entirely. Remediation is available in version 0.9.6 and later.

Business impact

This vulnerability enables lateral data exposure within multi-user Open WebUI deployments. In organizations using Open WebUI for collaborative AI workflows, authenticated users—whether employees, contractors, or partners—can systematically exfiltrate sensitive documents, source code, or personal files belonging to colleagues without leaving obvious audit trails. The LLM's natural ability to interpret and summarize content makes this particularly effective for extracting meaning from PDFs, images, and structured files. While privilege escalation is not possible, the confidentiality breach could expose trade secrets, personal information, or compliance-sensitive materials depending on deployment context.

Affected systems

Open WebUI versions prior to 0.9.6 are affected. The vulnerability requires authentication, so only deployments with user accounts are impacted; however, any instance with multiple users or untrusted users faces exposure. Self-hosted environments, whether on-premise or in cloud instances, are equally at risk. The issue does not affect downstream consumers using Open WebUI via API in a controlled, single-user context, but multi-user SaaS-style deployments are particularly vulnerable.

Exploitability

Exploitation requires valid user credentials and knowledge—or guessable inference—of target file IDs. The attack is straightforward: craft a chat completion request, set image_url.url to a known file ID, and prompt the LLM to describe the content. No special tools or network access are needed beyond the application UI. The CVSS score of 6.5 (Medium) reflects that authentication is mandatory and the impact is confidentiality only; however, the ease of execution and the total absence of application-level logging or notifications for cross-user file access means attacks may go undetected. The attack surface is broad in any organization where user-to-user trust is assumed but not enforced technically.

Remediation

Upgrade to Open WebUI version 0.9.6 or later immediately. The patch implements proper ownership verification before resolving file IDs in the image_url parameter, ensuring users can only reference their own files. Verify the upgrade by checking the application version in the UI or logs. Organizations unable to upgrade immediately should disable file upload features or restrict the chat completions API to single-user or trusted-user-only deployments; however, these are temporary containment measures and do not replace patching.

Patch guidance

Apply Open WebUI 0.9.6 as soon as feasible. The fix is contained in a single release and carries no known breaking changes relative to earlier 0.9.x versions. Deployment method depends on your installation: Docker-based deployments should pull the updated image; source installations should checkout the 0.9.6 tag. Verify after upgrade by confirming the version in application settings and testing that file references are properly scoped to the logged-in user. No database migration or configuration changes are required.

Detection guidance

Monitor application logs for patterns indicating cross-user file access attempts: look for chat API requests that reference file IDs not created by the requesting user, particularly if the same file ID appears in requests from multiple different user accounts. Enable debug logging on the /api/chat/completions endpoint if available. Examine user behavior for unusual LLM prompts requesting OCR, transcription, or description of content the user did not personally upload. Periodic file ownership audits—comparing file metadata to user accounts—can reveal evidence of past access. Note that the vulnerability produces no obvious error messages; successful exploitation appears as ordinary chat requests.

Why prioritize this

While the CVSS score is Medium (6.5), the practical risk is elevated in multi-user deployments due to the ease of exploitation, the silent nature of the attack, and the sensitivity of documents typically stored in AI platforms. The lack of a KEV listing indicates no active exploitation in the wild has been reported; however, the simplicity of the attack and its applicability to any Open WebUI instance with >1 user means this should be treated as a near-term patch priority for affected organizations. Prioritize based on deployment scope: single-user instances are low risk; multi-user enterprise instances are high risk.

Risk score, explained

CVSS 6.5 reflects a network-accessible, low-complexity attack requiring authentication (PR:L) with no user interaction, resulting in high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N). The Medium severity appropriately captures the authentication requirement and absence of system-wide compromise; however, the authorization flaw and potential for bulk data extraction may warrant organizational risk elevation in high-sensitivity environments. Consider internal risk amplification if your deployment hosts classified, regulated, or high-value proprietary content.

Frequently asked questions