HIGH SeverityCVSS 3.18.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVE-2026-45301

Last updated May 15, 2026 · Published May 15, 2026

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.

Affected products

1 listed

open-webui:open-webui

Mappings

CWE

CWE-284

CAPEC

None listed.