CVE-2026-54010: Open WebUI File Access Control Bypass

Technical summary

CVE-2026-54010 is an improper access control vulnerability in Open WebUI's file handling mechanism. The vulnerability stems from insufficient authorization checks in the file attachment logic. When an authenticated user attaches a file_id to a chat message, the application fails to verify ownership or read permissions for that file. When the chat is subsequently shared and the attacker grants themselves read access, the has_access_to_file() function incorrectly treats the referenced file as accessible through the shared chat context. This allows attackers to read arbitrary files or trigger deletion operations on files they do not own. The attack requires prior authentication and administrative ability to share chats, but no user interaction from the victim is needed once the chat is shared.

Business impact

Organizations deploying Open WebUI for sensitive AI workloads face data exposure risk. An insider or compromised account could exfiltrate confidential documents, model training data, or other files stored within the instance. The integrity impact is also significant—attackers can delete files they reference, potentially destroying records or disrupting AI model operations. In multi-tenant or collaborative environments, this vulnerability effectively breaks file-level access controls and could enable lateral movement across user data boundaries.

Affected systems

Open WebUI versions prior to 0.9.6 are affected. This includes all self-hosted deployments running earlier releases. Organizations should identify instances in production or development environments and verify the running version. The vulnerability requires the attacker to be an authenticated user, so it does not affect completely air-gapped deployments without user accounts or instances restricted to trusted networks.

Exploitability

The attack is moderately easy to execute for an authenticated user with chat-sharing privileges. No complex exploitation techniques, user interaction, or special network conditions are required. However, the attacker must already have valid credentials and permissions to create or share chats. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog as of the publication date, but the straightforward nature of the flaw means functional exploitation code is likely to emerge quickly once details are widely known.

Remediation

Upgrade Open WebUI to version 0.9.6 or later, which implements proper file ownership and access control validation before allowing file references in chat messages. Verify that the patched version has been deployed across all instances. For organizations unable to patch immediately, restrict chat-sharing features and limit authenticated user accounts to trusted personnel only. Review recent chat-sharing activity in audit logs to identify potential unauthorized file access.

Patch guidance

Deploy Open WebUI 0.9.6 or any subsequent release. The patch adds authorization checks to verify that users own or have explicit read access to files before permitting attachment to chat messages. After updating, test chat sharing functionality to confirm files are properly isolated between users. Monitor for any unusual file access or deletion patterns in the days following deployment.

Detection guidance

Hunt for indicators in application logs: look for chat-sharing events followed by file read or delete operations on files not owned by the sharing user. Monitor for multiple file_id references within a single chat from a user who does not ordinarily work with those files. Check for rapid sequential file deletions by a single user account. Network-based detection is limited since the attack occurs within the application layer; focus on log analysis and access pattern anomalies. If available, enable verbose logging for file operations and chat sharing.

Why prioritize this

This vulnerability warrants prompt patching due to its high CVSS score (8.3), broad impact on confidentiality and integrity, low attack complexity, and the fact that it requires only authenticated access rather than network-level privileges. Data exfiltration and file destruction are material business risks. The attack surface is limited to authenticated users, which lowers urgency in completely isolated environments, but any Open WebUI instance with multiple users or untrusted accounts should be prioritized.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects the combination of high confidentiality impact (unauthorized file read), high integrity impact (file deletion), low availability impact, low attack complexity, and the requirement for authenticated access. The network-based attack vector and lack of user interaction increase severity. The score appropriately emphasizes that while authentication is required, the consequences of exploitation are severe and the barrier to execution is minimal for an insider or compromised account.

Frequently asked questions