5Yu4N

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.9.6 **Description** An authenticated user can attach arbitrary `file id` values to their own chat messages because the system fails to verify if the user owns or has read access to those files. By sharing the chat and granting themselves read access, the `has access to file()` function incorrectly treats the victim's file as accessible. This allows an attacker to read a victim's file via the 'GET /api/v1/files/{id}/content' endpoint or delete it via the 'DELETE /api/v1/files/{id}' endpoint. Additionally, the shared-chat authorization branch ignores the `access type`, meaning a user granted only read access to a legitimately shared chat can delete files attached to that chat. **Recommendations** Update to version 0.9.6 or later. As a temporary workaround, restrict access to the 'GET /api/v1/files/{id}/content' and 'DELETE /api/v1/files/{id}' endpoints to authorized administrators only.

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.9.6 **Description** Open WebUI allows users with permissions to create, update, or import workspace models to store arbitrary `meta.knowledge` entries without verifying ownership or read access to the referenced files. The system treats `meta.knowledge` entries of type `file` as an authorization source, which can be exploited by a malicious model owner to attach another user's file ID to their model metadata. This allows the attacker to read or delete private files belonging to other users. Technical details include: - **API Endpoints:** `GET '/api/v1/files/{id}/content'` and `DELETE '/api/v1/files/{id}'` can be used to read or delete unauthorized files. - **Vulnerable Parameters:** The `meta.knowledge` field within the model metadata is used to inject unauthorized file IDs. - **Function Names:** The `view file()` tool and the `has access to file()` function incorrectly trust the forged metadata for authorization. **Recommendations** Update to version 0.9.6. As a temporary workaround, restrict the `workspace.models` and `workspace.models import` permissions to trusted users only to prevent the creation of malicious models.

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.9.6 **Description** Open WebUI contains an authorization flaw in its prompt version-history endpoints. While the system authorizes the `prompt id` provided in the URL, it fails to verify that the requested history entries actually belong to that specific prompt. An authenticated user with access to any prompt they control can use a victim's history ID to read or delete another user's private prompt history, which may contain private text, internal instructions, and sensitive variables. Technical details regarding the affected endpoints: - '/api/v1/prompts/id/{prompt id}/history/diff' (GET): Allows reading another prompt's history snapshots. - '/api/v1/prompts/id/{prompt id}/update/version' (POST): Allows restoring another prompt's snapshot into the caller's prompt, exposing its content. - '/api/v1/prompts/id/{prompt id}/history/{history id}' (DELETE): Allows deleting another prompt's history entry. The issue stems from the `compute diff()`, `update prompt version()`, and `delete history entry()` functions, which fetch history entries globally by ID without ensuring the `prompt id` matches the authorized prompt. **Recommendations** Update to version 0.9.6.

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4 Description Multiple Host headers were permitted in AIOHTTP, potentially allowing a reverse proxy's security rules to be bypassed. This could lead to a request being processed by AIOHTTP in a privileged sub application when using `Application.add domain()` if the proxy and AIOHTTP process different host names. Recommendations Update to AIOHTTP version 3.13.4 or later.