{"data":{"id":"a5747021-3908-4347-9d0f-cb612e3f2213","title":"GHSA-w9f8-gxf9-rhvw: Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories","summary":"GHSA-w9f8-gxf9-rhvw reports that Open WebUI v0.8.3 lets any authenticated user read other users' private files and memories through the POST /api/v1/retrieval/query/collection endpoint. The query_collection_handler in backend/open_webui/routers/retrieval.py checks authentication but performs no ownership validation on the supplied collection_names. The reporter also states that /api/v1/users/search exposes all user UUIDs, emails, names and roles, and that memory leakage requires the Memory experimental feature to be enabled.","solution":"The source text is truncated before its suggested fix. The only fix described is \"Add ownership validation in /api/v1/retrieval/query/collection\", and the code sample that follows is cut off.","labels":["security","privacy"],"sourceUrl":"https://github.com/advisories/GHSA-w9f8-gxf9-rhvw","publishedAt":"2026-03-27T15:35:49.000Z","cveId":"CVE-2026-29071","cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["open-webui@<= 0.8.5 (fixed: 0.8.6)"],"affectedPackageNames":["open-webui"],"affectedPackageRefs":["pypi:open-webui"],"affectedVendors":[],"affectedVendorsRaw":["Open WebUI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00263,"epssCheckedAt":"2026-11-09T18:09:53.615Z","kevDateAdded":null,"advisoryAliases":["GHSA-w9f8-gxf9-rhvw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-27T15:35:49.000Z","fixReleasedAt":"2026-03-01T21:09:40.090Z","daysToFix":-26,"fixCheckedAt":"2026-10-29T21:39:24.462Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"open-webui","fixedVersion":"0.8.6","matchedVersion":"0.8.6","fixReleasedAt":"2026-03-01T21:09:40.090Z","daysToFix":-26,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:39:24.318Z"}]}}