CVE-2026-45301

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.3.16

Description A missing permission check in API endpoints related to files allows any authenticated user to list, access, and delete every file uploaded by any user to the platform. The issue exists because the endpoints only verify if a user is authenticated but do not filter files to match the user id of the requesting user. Affected endpoints include '/api/v1/files/', '/api/v1/files/{id}/content', and '/api/v1/files/{id}'.

Recommendations Update to version 0.3.16.