Home

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.

PUBLISHED Reserved 2026-05-11 | Published 2026-05-15 | Updated 2026-05-19 | Assigner GitHub_M




HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-284: Improper Access Control

Product status

< 0.3.16
affected

References

github.com/...-webui/security/advisories/GHSA-r8wh-8m7r-fh33 exploit

github.com/...-webui/security/advisories/GHSA-r8wh-8m7r-fh33

cve.org (CVE-2026-45301)

nvd.nist.gov (CVE-2026-45301)

Download JSON