CVE-2026-70487

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.8 through 0.10.2

Description An issue exists where inline direct model metadata accepts client-supplied knowledge attachments without verifying the caller's read access. This occurs when a client defines a model inline during a chat request rather than selecting a saved workspace model. An authenticated user who possesses another user's file ID can cause the builtin knowledge tools to return indexed chunks from that file, leading to a read-only cross-user confidentiality loss. This affects the chat completion, chat completed, and chat action endpoints. The exploitation requires the use of native function calling and that the model's builtin tools capability is enabled.

Recommendations Update to version 0.11.0.