Untriaged
Permalink
CVE-2026-29071
3.1 LOW
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): NONE
- Availability impact (A): NONE
Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can read other users' private memories via `/api/v1/retrieval/query/collection`. Version 0.8.6 patches the issue.
References
-
https://github.com/open-webui/open-webui/security/advisories/GHSA-w9f8-gxf9-rhvw x_refsource_CONFIRM
Affected products
open-webui
- ==< 0.8.6
Package maintainers
-
@drupol Pol Dellaiera <pol.dellaiera@protonmail.com>
-
@shivaraj-bh Shivaraj B H <sbh69840@gmail.com>