CVE-2026-44560

Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Affected Component

RAG source resolution in chat completion pipeline:

• backend/open_webui/retrieval/utils.py (lines 963-965, 1063-1068, 1126-1131 in get_sources_from_items)

Affected Versions

Current main branch (commit 6fdd19bf1) and likely all versions with RAG functionality.

Description

The get_sources_from_items function resolves file and knowledge base references into vector search queries during chat completion. Three of the five code paths perform vector store queries without any authorization check, allowing users to extract content from files and knowledge bases they do not have access to.

The three unprotected paths pass user-supplied collection names directly to query_collection(), which queries the vector store without any authorization. Collection names follow predictable formats: file-<file_id> for files and the knowledge base UUID for knowledge bases.

CVSS 3.1 Breakdown

Attack Scenario

1. User A uploads a private document and uses it in RAG (the document is embedded into the vector store as collection file-<file_id>).
2. User A shares a chat or model referencing the file with User B, or User B otherwise obtains the file ID through a legitimate interaction.
3. User A later revokes User B's access to the file.
4. User B sends a chat completion request referencing the revoked file:

   POST /api/chat/completions
   {
     "model": "any-accessible-model",
     "messages": [{"role": "user", "content": "What does this document say about pricing?"}],
     "files": [{"type": "file", "id": "<revoked_file_id>"}]
   }
   

5. The non-full-context path (default) constructs collection name file-<id> and queries the vector store with no access check.
6. Matching chunks are injected into the LLM context, and the response contains the victim's private file content.

The same attack works via {"type": "text", "collection_name": "<knowledge_base_id>"} for knowledge bases.

Preconditions

• Attacker must know the file ID or knowledge base ID (UUID) of the target resource
• The target file/knowledge base must have been processed into the vector store
• Attacker must have a valid user account

• Access revocation is ineffective for RAG content, users who previously had access can continue extracting file and knowledge base content indefinitely
• Private document content can be systematically extracted through targeted queries
• Breaks the access control model for files and knowledge bases at the RAG layer

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

CVE-2026-44560 has a CVSS score of 6.5 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.9.0); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-44560? CVE-2026-44560 is a medium-severity missing authorization vulnerability in open-webui (pip), affecting versions <= 0.8.12. It is fixed in 0.9.0. The application does not perform an authorization check before performing a sensitive operation.
2. How severe is CVE-2026-44560? CVE-2026-44560 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of open-webui are affected by CVE-2026-44560? open-webui (pip) versions <= 0.8.12 is affected.
4. Is there a fix for CVE-2026-44560? Yes. CVE-2026-44560 is fixed in 0.9.0. Upgrade to this version or later.
5. Is CVE-2026-44560 exploitable, and should I be worried? Whether CVE-2026-44560 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-44560 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-44560? Upgrade open-webui to 0.9.0 or later.