GHSA-4g37-7p2c-38r9: Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls

Summary

Open WebUI's `_validate_collection_access()` checks only the `user-memory-*` and `file-*` collection name prefixes, so knowledge base collections named with raw UUIDs pass unchecked. Any authenticated non-admin user who knows a private knowledge base UUID can read its content through the `/api/v1/retrieval/query/doc` and `/api/v1/retrieval/query/collection` endpoints. The same gap lets an attacker write to another user's knowledge base through the `/api/v1/retrieval/process/*` endpoints, including overwriting content.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Related items

• MediumChina-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenantsSimilar attack · CSO Online
• MediumChina-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain AttackSimilar attack · The Hacker News
• MediumOpenAI’s models are deliberately breaking their misalignment monitoring systemsSimilar attack · CSO Online
• InfoGoogle Chrome adds Gemini-powered scam detection, warns users of ClickFix attacksSimilar attack · BleepingComputer
• MediumAI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseSimilar attack · Microsoft Security Blog