CVE-2026-54012: Open WebUI Authorization Bypass Allows Unauthorized File Access

Technical summary

CVE-2026-54012 is an improper authorization vulnerability in Open WebUI prior to 0.9.6 affecting the model metadata (meta.knowledge) handling. The flaw exists in two components: (1) the create/update/import model endpoints do not validate ownership of file IDs referenced in meta.knowledge entries, and (2) the has_access_to_file() function's model branch uses these unchecked metadata entries as the sole authorization source for the view_file tool and file delete operations. An authenticated user can craft a model with arbitrary file references, then invoke file read or delete operations that bypass the normal access control checks because the system trusts the model metadata as truth. This represents broken access control at the API level where file authorization is delegated to user-controlled metadata rather than enforced server-side.

Business impact

In multi-tenant or collaborative Open WebUI environments, this vulnerability enables data exfiltration and destruction. An attacker with model creation privileges can read sensitive files uploaded by colleagues or system administrators, exposing trade secrets, credentials, or personal data. The ability to delete files creates a secondary risk of business disruption and potential non-compliance with data retention policies. For organizations relying on Open WebUI as a central AI platform, this threatens the confidentiality and integrity of all file-based assets accessible to other users.

Affected systems

Open WebUI versions prior to 0.9.6 are affected. Any deployment allowing multiple users to create or import models is at risk if those users cannot be fully trusted. Self-hosted instances with file upload capabilities and shared model repositories are the primary target. The vulnerability does not require network access beyond what is normal for the platform; it is triggered by authenticated actions within the UI or API.

Exploitability

Exploitation requires valid Open WebUI credentials and the ability to create or update a model—a privilege typically granted to regular users. No special tools or advanced techniques are needed; an attacker simply references a target user's file ID in their model's metadata. The attack is reliable once a file ID is known or enumerated. However, the CVSS score of 7.1 reflects that local access control context and lack of public exploit code reduce the immediate attack surface compared to unauthenticated flaws. Insider threats and compromised accounts are the primary risk vectors.

Remediation

Upgrade Open WebUI to version 0.9.6 or later, which implements proper authorization checks on meta.knowledge file entries. The fix validates that the model owner has legitimate access to any file referenced in metadata before allowing file operations to proceed. Organizations should prioritize patching in environments with multiple users or where model sharing is enabled.

Patch guidance

Apply the 0.9.6 release or any subsequent version. Review vendor advisories and release notes to confirm that the authorization validation has been implemented. If running a containerized deployment, pull the updated image tag and restart services. Test in a staging environment first to ensure no workflow disruptions.

Detection guidance

Monitor for suspicious patterns: (1) a single user creating multiple models in rapid succession, particularly if followed by file deletion events tied to other users, (2) file delete or view operations preceded by recent model import or update actions, (3) audit logs showing file access by users who did not directly upload the file. Implement file-level access logging to correlate model metadata changes with subsequent file operations. Search for model metadata entries (meta.knowledge) that reference file IDs not created by the model owner.

Why prioritize this

This flaw merits high priority because it directly compromises user data isolation in multi-user environments and is straightforward to exploit once an attacker has credentials. While it requires authentication and is not yet in the wild (KEV status is negative), the logic flaw is fundamental and affects core file handling. Organizations running Open WebUI in collaborative settings should patch immediately to restore proper access controls.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects a high-impact vulnerability with significant barriers to exploitation. Attack Vector is Network, Attack Complexity is High (requires understanding of file IDs and model import workflows), and Privileges Required is Low (standard user). Confidentiality and Integrity impacts are High (file read and delete), while Availability impact is Low. The score appropriately weights the need for authentication and local knowledge against the serious consequences of successful exploitation.

Frequently asked questions