Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filter. An authenticated user on an affected backend could enumerate the identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection, although the associated document text remained in separate collections. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T22:18:47.023Z",
  "pubdate": "2026-09-09T22:18:47.023Z",
  "executiveSummary": "Open WebUI version 0.7.0 through 0.11.1 contains a security vulnerability where the built-in knowledge search tool fails to enforce metadata filters across eleven integrated vector backends.\nThis flaw enables an authenticated user to perform unauthorized enumeration of sensitive metadata, including identifiers, names, and descriptions of knowledge bases they are not permitted to access.\nWhile the vulnerability facilitates the disclosure of metadata, it does not provide direct read access to the actual document text associated with these private knowledge bases, as document storage is segregated from the metadata collections.\nThe risk is primarily classified as an Information Disclosure vulnerability, specifically concerning unauthorized data harvesting of system configurations and knowledge base structures.\nExploitation requires the attacker to hold an authenticated session within the platform. The vulnerability arises from an improper implementation of access control logic within the abstraction layer connecting the application to the underlying vector databases.\nTo mitigate this risk, administrators must update the platform to version 0.11.1 or higher, which enforces strict metadata filtering during search operations.",
  "technicalDetails": "The vulnerability resides within the interaction layer between Open WebUI and its supported vector backends. The platform utilizes a knowledge search tool designed to filter results based on the caller's readable knowledge identifiers. However, the internal search implementation fails to pass these filters to the query execution layer for eleven specific vector backends.\nRoot Cause: A failure in the abstraction layer logic ensures that the metadata filter, intended to constrain search results to authorized knowledge bases, is ignored during the vector search process. Consequently, the backend performs an exhaustive search over all available knowledge base collections regardless of user permissions.\nAttack Flow: An authenticated attacker initiates a search query via the Open WebUI interface or API. The request is processed by the search tool, which identifies the appropriate vector backend. Due to the missing filter enforcement, the backend returns metadata—specifically unique identifiers, naming conventions, and descriptive metadata—for all knowledge collections in the shared index. The client-side application then renders these unauthorized metadata points to the user interface.\nVulnerability Scope: This issue affects Open WebUI versions ranging from 0.7.0 to 0.11.1. The vulnerability is present when any of the eleven vulnerable vector backend implementations are active. The flaw does not allow for Arbitrary Code Execution (ACE) or direct Document Content Retrieval, as the document text objects reside in distinct, non-enumerated collections; however, the exposure of metadata allows an attacker to map the internal structure, naming schemes, and organizational context of private knowledge bases.\nExploitation Requirements: The attacker must have a valid authenticated account within the Open WebUI instance. The exploitation does not require administrative privileges, as standard authenticated users can query the search endpoint. The exploit is performed over the network via standard HTTPS requests directed at the platform’s search API endpoint.\nPost-Exploitation Impact: An attacker can leverage the gathered metadata to identify potentially sensitive research topics, internal project names, or proprietary data structures. This information can serve as reconnaissance for more advanced targeted attacks or to infer the content of restricted datasets based on the descriptive metadata harvested during enumeration."
}