Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, _validate_collection_access() checks the user-memory-* and file-* collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any authenticated user who knows a private knowledge base UUID can read its content through the retrieval query endpoints, even though the knowledge API correctly denies that user access. The same gap affects the retrieval write endpoints (/process/text, /process/file, /process/files/batch, /process/web, /process/youtube), allowing an attacker to inject content into or overwrite another user's knowledge base. This vulnerability is fixed in 0.9.5.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-45398 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, _validate_collection_access() checks the user-memor… https://www.cve.org/CVERecord?id=CVE-2026-45398
Post summary
This statement announces CVE‑2026‑45398 for Open WebUI, noting a security check deficit before version 0.9.5, but provides no PoC, exploit, or patch details.
Open WebUI Multiple Vulnerabilities https://ift.tt/25UmDYK Open WebUI Multiple Vulnerabilities CVE-2026-45398 - IDOR: Retrieval API Bypasses Knowledge Base Access Controls Summary _validate_collection_access() (PR #22109) checks the user-memory-* and file-* collection name …
Post summary
The post announces the discovery of an Indirect Data Retrieval (IDOR) vulnerability (CVE-2026-45398) in Open WebUI's Retrieval API, providing a brief technical description but no PoC, exploit, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openwebui | open_webui | - | - | - |