CVE-2026-45398

Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls

• Confidentiality: Any authenticated user can read private knowledge base contents belonging to other users on the instance.
• Integrity: Attacker-controlled content can be injected into another user's knowledge base, poisoning downstream RAG results. Injected prompt-injection payloads would be passed to the model when the victim queries the knowledge base.
• Availability: /process/web and /process/youtube default to overwrite=true, letting an attacker delete and replace a victim's entire knowledge base in a single request.

CVE-2026-45398 has a CVSS score of 7.5 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.9.5); upgrading removes the vulnerable code path.

Kodem intelligence

Two changes are needed:

1. Add a permission parameter to _validate_collection_access, use it for both file-* and knowledge base checks, and add a knowledge base ownership/access check for collection names that do not match the existing prefixes. AccessGrants.has_access already resolves group memberships internally when user_group_ids is omitted, matching the pattern used throughout knowledge.py.

2. The affected write endpoints must call _validate_collection_access with permission="write" before operating on the provided collection_name.

--- a/backend/open_webui/routers/retrieval.py
+++ b/backend/open_webui/routers/retrieval.py
@@ -39,4 +39,5 @@
 from open_webui.models.files import FileModel, FileUpdateForm, Files
 from open_webui.utils.access_control.files import has_access_to_file
 from open_webui.models.knowledge import Knowledges
+from open_webui.models.access_grants import AccessGrants
 from open_webui.storage.provider import Storage

@@ -2330,26 +2331,39 @@
-def _validate_collection_access(collection_names: list[str], user) -> None:
+def _validate_collection_access(collection_names: list[str], user, permission: str = "read") -> None:
     if user.role == "admin":
         return

     for name in collection_names:
         if name.startswith("user-memory-") and name != f"user-memory-{user.id}":
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
             )
         elif name.startswith("file-"):
             file_id = name[len("file-"):]
-            if not has_access_to_file(
-                file_id=file_id,
-                access_type="read",
-                user=user,
-            ):
+            if not has_access_to_file(
+                file_id=file_id,
+                access_type=permission,
+                user=user,
+            ):
                 raise HTTPException(
                     status_code=status.HTTP_403_FORBIDDEN,
                     detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
                 )
+        else:
+            knowledge = Knowledges.get_knowledge_by_id(id=name)
+            if knowledge and knowledge.user_id != user.id:
+                if not AccessGrants.has_access(
+                    user_id=user.id,
+                    resource_type="knowledge",
+                    resource_id=name,
+                    permission=permission,
+                ):
+                    raise HTTPException(
+                        status_code=status.HTTP_403_FORBIDDEN,
+                        detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+                    )

The existing read callers (/query/doc, /query/collection) use the default permission="read" and require no change. Each affected write endpoint needs a validation call after collection_name is resolved:

/process/text (line 1777):

@@ -1783,5 +1783,6 @@
     collection_name = form_data.collection_name
     if collection_name is None:
         collection_name = calculate_sha256_string(form_data.content)
+    _validate_collection_access([collection_name], user, permission="write")

     docs = [

/process/web and /process/youtube (lines 1810-1811, same handler):

@@ -1824,5 +1824,6 @@
             collection_name = form_data.collection_name
             if not collection_name:
                 collection_name = calculate_sha256_string(form_data.url)[:63]
+            _validate_collection_access([collection_name], user, permission="write")

             if not request.app.state.config.BYPASS_WEB_SEARCH_EMBEDDING_AND_RETRIEVAL:

/process/file (line 1528):

@@ -1548,6 +1548,7 @@
             collection_name = form_data.collection_name
             if collection_name is None:
                 collection_name = f"file-{file.id}"
+            _validate_collection_access([collection_name], user, permission="write")

             if form_data.content:

/process/files/batch (line 2578):

@@ -2593,3 +2593,4 @@
     collection_name = form_data.collection_name
+    _validate_collection_access([collection_name], user, permission="write")

     file_results: List[BatchProcessFilesResult] = []

1. What is CVE-2026-45398? CVE-2026-45398 is a high-severity security vulnerability in open-webui (pip), affecting versions <= 0.9.4. It is fixed in 0.9.5.
2. How severe is CVE-2026-45398? CVE-2026-45398 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of open-webui are affected by CVE-2026-45398? open-webui (pip) versions <= 0.9.4 is affected.
4. Is there a fix for CVE-2026-45398? Yes. CVE-2026-45398 is fixed in 0.9.5. Upgrade to this version or later.
5. Is CVE-2026-45398 exploitable, and should I be worried? Whether CVE-2026-45398 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-45398 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-45398? Upgrade open-webui to 0.9.5 or later.