CVE-2026-109287

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109287
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109287.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109287
Aliases
  • GHSA-jx3w-3pqq-7f3w
Published
2026-10-12T16:04:49Z
Modified
2026-10-13T02:46:40Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID
Details

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109287.json"
}
References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type
GIT
Repo
https://github.com/open-webui/open-webui
Events
Introduced
1a97751e376e00a1897bc3679215ae1c7bd8fd42
Fixed
8bd8b4fac5e059578ac0c74b3c18d11139f88b7d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.9.6"
        },
        {
            "fixed":  "0.11.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109287.json"