{"data":{"id":"445f8336-b67b-460d-990e-62304d2f9830","title":"GHSA-jjp7-g2jw-wh3j: Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite","summary":"Any authenticated Open WebUI user can overwrite any file by ID through the POST /api/v1/retrieval/process/files/batch endpoint, because process_files_batch() in backend/open_webui/routers/retrieval.py has no ownership check before writing. Attackers can obtain valid file UUIDs from GET /api/v1/knowledge/{id}/files for any knowledge base they can read, and the overwritten content is then served to the LLM via RAG. Tested on Open WebUI 0.8.3 in a default Docker configuration.","solution":"Suggested fix: add an ownership check before writing, rejecting the file with \"Permission denied: not file owner\" unless db_file.user_id matches the requesting user or the user is an admin. No released fixed version is stated in the source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-jjp7-g2jw-wh3j","publishedAt":"2026-03-27T15:34:26.000Z","cveId":"CVE-2026-28788","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["rag_poisoning"],"issueType":"vulnerability","affectedPackages":["open-webui@< 0.8.6 (fixed: 0.8.6)"],"affectedPackageNames":["open-webui"],"affectedPackageRefs":["pypi:open-webui"],"affectedVendors":[],"affectedVendorsRaw":["Open WebUI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.03034,"epssCheckedAt":"2026-11-13T00:12:55.801Z","kevDateAdded":null,"advisoryAliases":["GHSA-jjp7-g2jw-wh3j"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-27T15:34:26.000Z","fixReleasedAt":"2026-03-01T21:09:40.090Z","daysToFix":-26,"fixCheckedAt":"2026-10-29T21:39:25.197Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"rag","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0070"],"fixes":[{"ecosystem":"pypi","name":"open-webui","fixedVersion":"0.8.6","matchedVersion":"0.8.6","fixReleasedAt":"2026-03-01T21:09:40.090Z","daysToFix":-26,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:39:25.052Z"}]}}