CVE-2026-54019

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6

Description An issue exists in the self-hosted artificial intelligence platform where collection-level Access Control List (ACL) checks can be bypassed when Milvus multitenancy mode is enabled. The ACL permits unknown non-Knowledge Base (KB) collection names, treating them as legacy or ephemeral collections. In Milvus multitenancy mode, a user-controlled collection name is used as a resource id and interpolated into a Milvus expression without proper escaping. This allows an authenticated non-admin user to execute queries that return private knowledge-base chunks belonging to other users.

Technical details include:

Recommendations Update to version 0.9.6. As a temporary workaround, restrict access to the '/api/v1/retrieval/query/collection' and '/api/v1/retrieval/query/doc' endpoints or disable Milvus multitenancy mode until the update is applied.