CVE-2026-109285

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109285

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109285.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109285

Aliases

GHSA-9cxp-636w-4997

Published

2026-10-12T16:04:47Z

Modified

2026-10-13T02:45:48Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Details

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109285.json"
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

04799f1f95f958674d35ba4854ef62754a4d332e

Fixed

8bd8b4fac5e059578ac0c74b3c18d11139f88b7d

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.6.0"
        },
        {
            "fixed":  "0.11.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.10.0

v0.10.1

v0.10.2

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.6.0

v0.6.1

v0.6.10

v0.6.11

v0.6.12

v0.6.13

v0.6.14

v0.6.15

v0.6.16

v0.6.17

v0.6.18

v0.6.19

v0.6.2

v0.6.20

v0.6.21

v0.6.22

v0.6.23

v0.6.24

v0.6.25

v0.6.26

v0.6.27

v0.6.28

v0.6.29

v0.6.3

v0.6.30

v0.6.31

v0.6.32

v0.6.33

v0.6.34

v0.6.35

v0.6.36

v0.6.37

v0.6.38

v0.6.39

v0.6.4

v0.6.40

v0.6.41

v0.6.42

v0.6.43

v0.6.5

v0.6.6

v0.6.7

v0.6.8

v0.6.9

v0.7.0

v0.7.1

v0.7.2

v0.8.0

v0.8.1

v0.8.10

v0.8.11

v0.8.12

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109285.json"