CVE-2026-109287: Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Q: Which users can exploit this issue?

Any user with read access to at least one knowledge base can exploit it. The user must also have a retained UUID for a directory belonging to another knowledge base.

Q: What information can be exposed?

The affected file-listing endpoint returns breadcrumb data for the foreign directory and its ancestors. This can disclose folder names, owner user IDs, and knowledge base IDs.

Q: Which endpoint is involved?

The issue affects GET /api/v1/knowledge/{id}/files when a supplied directory_id is not verified as belonging to the requested knowledge base.

Q: How can teams assess whether they may have been exposed?

Review requests to GET /api/v1/knowledge/{id}/files for directory_id values that do not belong to the knowledge base identified by {id}. Such requests from users who can read a different knowledge base indicate potential attempted or successful disclosure.

Published Oct 12, 2026

Updated

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.

Affected Software

1 affected component

Open WebUI Open WebUI>=0.9.6<0.11.4

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any user with read access to at least one knowledge base can exploit it. The user must also have a retained UUID for a directory belonging to another knowledge base.

What information can be exposed?

The affected file-listing endpoint returns breadcrumb data for the foreign directory and its ancestors. This can disclose folder names, owner user IDs, and knowledge base IDs.

Which endpoint is involved?

The issue affects GET /api/v1/knowledge/{id}/files when a supplied directory_id is not verified as belonging to the requested knowledge base.

How can teams assess whether they may have been exposed?

Review requests to GET /api/v1/knowledge/{id}/files for directory_id values that do not belong to the knowledge base identified by {id}. Such requests from users who can read a different knowledge base indicate potential attempted or successful disclosure.

CVE-2026-109287: Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What information can be exposed?

Which endpoint is involved?

How can teams assess whether they may have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What information can be exposed?

Which endpoint is involved?

How can teams assess whether they may have been exposed?