CVE-2026-109285

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.0 through 0.11.3

Description An improper access control issue exists in the has access to file() function. This flaw allows former knowledge base collaborators to maintain access to files through stale cached knowledge base references. Users with read or write grants can exploit this to download removed files via the file content endpoint or delete them, including files located within the owner's private knowledge bases.

Recommendations Update Open WebUI to version 0.11.4 or later.