CVE-2026-70487: Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

A chat request can carry an inline model definition instead of naming a saved workspace model. The chat completion, chat completed and chat action endpoints accepted the knowledge attached to that inline model without checking that the caller could read it. Saved workspace models are validated against their author when created, updated or imported. Inline models skip that path, yet downstream code trusted them equally, including a helper that grants file read access just because the running model claims the file as attached knowledge.

The attacker sends a chat request with an inline model that lists the target file id as knowledge, and the builtin knowledge tools return that file's indexed chunks. They need an account of any role, a session id on the request, native function calling (the default, since only function_calling: legacy opts out) and the builtin_tools capability enabled (also the default). No admin setting is needed: Direct Connections need not be on.

The flaw is limited by the id requirement. File ids are UUIDs and cannot be enumerated through this path, so the attacker must already hold the id. It is read-only. Knowledge bases attached this way were never affected.

Open WebUI >= 0.8.8, <= 0.10.2, in default configuration. Check the version:

pip show open-webui

Exposure is greatest where users share chats, file ids or exports that might reveal another person's file id.

Upgrade to 0.11.0:

pip install --upgrade open-webui==0.11.0

Commit 305880f2e filters an inline model's attached knowledge against the caller's real read access before use, dropping any file, knowledge base or note the caller cannot read. No configuration change is needed. Setting function_calling to legacy or disabling the builtin_tools capability would sidestep the path according to the preconditions, but the advisory does not offer that as a workaround.

Look in request logs for chat completion calls whose body includes an inline model object with a knowledge list that names file ids belonging to other users. Compare file ids in those requests with each file's owner. Unexpected builtin knowledge-tool calls from an account that does not own the referenced files are the signal.

Summary

Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file id could therefore have the builtin knowledge tools return that file's indexed content back to them.

Preconditions

Authenticated user of any role, no admin rights needed. The request must carry a session id and use native function calling, which is the default (only function_calling: legacy opts out), and the model's builtin_tools capability must not be disabled (default enabled). The attacker must already know the target file's id; ids are UUIDs and are not enumerable through this path. No admin setting needs to be turned on: enabling Direct Connections is not required for the backend to accept an inline model. Knowledge bases attached this way were never affected, their own access grants were enforced on every path.

Impact

An authenticated user could read the indexed chunks of another user's or group's file, a cross-user confidentiality loss limited to files whose ids the attacker already holds. It is read-only: nothing is modified or deleted, knowledge-base permissions are unaffected, and saved workspace models were already validated at creation time.

Fix

Fixed in 0.11.0 by commit 305880f2e. An inline model's attached knowledge is filtered against the caller's real read access before it is used, dropping any file, knowledge base or note the caller cannot read. Upgrading fully resolves it, no configuration change is required.

Root cause

Affected component: the chat completion, chat completed and chat action endpoints, which accept an inline model definition, and the builtin knowledge tools that consume the model's attached knowledge. Affected setups: all builds from 0.8.8 through 0.10.2.

Saved workspace models have their attached file references validated against the author when the model is created, updated or imported, so a stored model can only carry files its creator can read. An inline model never passes through that path, yet everything downstream treated its attached knowledge with the same trust, including a helper that grants read access to a file purely because the running model claims it as attached knowledge. The missing control was an access check at the point where client-supplied model metadata enters the request.

Credits

Reported by @whyiug.