GHSA-w9f8-gxf9-rhvw: Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

Summary

GHSA-w9f8-gxf9-rhvw reports that Open WebUI v0.8.3 lets any authenticated user read other users' private files and memories through the POST /api/v1/retrieval/query/collection endpoint. The query_collection_handler in backend/open_webui/routers/retrieval.py checks authentication but performs no ownership validation on the supplied collection_names. The reporter also states that /api/v1/users/search exposes all user UUIDs, emails, names and roles, and that memory leakage requires the Memory experimental feature to be enabled.

Mitigation

The source text is truncated before its suggested fix. The only fix described is "Add ownership validation in /api/v1/retrieval/query/collection", and the code sample that follows is cut off.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News