PatchSiren cyber security CVE debrief
CVE-2026-70487 open-webui CVE debrief
Open WebUI, an extensible and feature-rich self-hosted AI platform, had a vulnerability from version 0.8.8 until 0.11.0. During this period, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. This oversight allowed any authenticated user who knew another user's file ID to access indexed chunks from that file through the builtin knowledge tools. Consequently, this led to a read-only cross-user confidentiality loss. The issue did not affect knowledge-base permissions or saved workspace model validation. The vulnerability is fixed in version 0.11.0, which properly filters knowledge attachments. Users and operators should review and update to this version to prevent such confidentiality losses.
- Vendor
- open-webui
- Product
- Unknown
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-04
- Original CVE updated
- 2026-08-05
- Advisory published
- 2026-08-04
- Advisory updated
- 2026-08-05
Who should care
Users of Open WebUI, especially those with multiple users and sensitive knowledge attachments, should review and update to version 0.11.0 or later to prevent cross-user confidentiality loss. Operators, security teams, and vulnerability management teams should assess exposure and prioritize updates based on sensitivity of knowledge attachments and user access controls.
Technical summary
Open WebUI, from version 0.8.8 until 0.11.0, accepted client-supplied knowledge attachments without filtering them against the caller's read access. This allowed authenticated users with knowledge of another user's file ID to access indexed chunks from that file, leading to read-only cross-user confidentiality loss. The issue is fixed in version 0.11.0, which properly filters knowledge attachments. This fix ensures that only authorized users can access specific knowledge attachments, thereby preventing unauthorized data exposure.
Defensive priority
Authenticated users with knowledge of another user's file ID could access indexed chunks from that file, leading to read-only cross-user confidentiality loss.
Recommended defensive actions
- Review and update Open WebUI to version 0.11.0 or later
- Restrict access to sensitive files and knowledge attachments
- Monitor for suspicious activity and implement compensating controls
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
Evidence notes
The CVE record indicates that Open WebUI, from version 0.8.8 until 0.11.0, accepted client-supplied knowledge attachments without filtering them against the caller's read access. This issue is fixed in version 0.11.0. Evidence is limited to CVE and NVD details. Defenders should verify Open WebUI version and knowledge attachment access controls.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T21:16:37.480Z and has not been modified since then.