CVE-2026-109287: Open WebUI: IDOR in KB listing leaks folder metadata

MEDIUMPoC AVAILABLECISA: TRACK*

Published October 12, 2026

CISO Take

Open WebUI versions 0.9.6 through 0.11.3 fail to check that a supplied directory_id belongs to the knowledge base being queried, so any authenticated user with read access to one knowledge base can pull folder names, owner user IDs and knowledge base IDs for any directory whose UUID they know. This is a low-severity information disclosure (CVSS 4.3) with no integrity or availability impact. There is no KEV listing, no public exploit and no Nuclei template, and EPSS data is not yet available. Exploitation also requires the attacker to already hold a valid foreign directory UUID, which limits practical abuse. Exposure matters mostly in multi-tenant or shared Open WebUI deployments where folder names or user IDs are sensitive, and the leaked IDs could help an attacker map other tenants for follow-on attacks. Upgrade to 0.11.4 or later at the next maintenance window. Until then, restrict self-registration and review who holds knowledge base read access.

Sources:NVDGitHub AdvisoryATLASvulncheck.com

What is the risk?

Low to medium overall. The flaw is network-reachable, low complexity, needs only low privileges and no user interaction, but it yields limited confidentiality impact (folder names, owner user IDs, knowledge base IDs). An attacker needs a valid directory UUID, which are random and not easily guessed. There is no known exploitation, no public PoC and no scanner template. Risk rises in multi-tenant deployments with open signup. The package has had 186 other CVEs, which points to a recurring authorization-hardening problem. Package risk score is 38/100.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege account that has read access to any knowledge base.

AML.T0012

Exploitation

Attacker sends GET /api/v1/knowledge/{id}/files with a foreign directory_id that the server does not validate against the knowledge base.

AML.T0049

Collection

The response breadcrumbs return folder names, owner user IDs and knowledge base IDs for the directory and all its ancestors.

AML.T0036

Impact

Leaked identifiers expose other tenants' data layout and support follow-on targeting of other users and knowledge bases.

AML.T0064

Initial Access

Attacker authenticates with a low-privilege account that has read access to any knowledge base.

AML.T0012

Exploitation

Attacker sends GET /api/v1/knowledge/{id}/files with a foreign directory_id that the server does not validate against the knowledge base.

AML.T0049

Collection

The response breadcrumbs return folder names, owner user IDs and knowledge base IDs for the directory and all its ancestors.

AML.T0036

Impact

Leaked identifiers expose other tenants' data layout and support follow-on targeting of other users and knowledge bases.

AML.T0064

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade open-webui to 0.11.4 or later (pip install -U open-webui, or pull the patched container image). 2) Until patched, disable open self-registration and limit knowledge base read grants to trusted users. 3) Review reverse proxy or application logs for GET /api/v1/knowledge/{id}/files requests carrying a directory_id parameter that does not match the knowledge base, and for one account querying many different directory IDs. 4) Treat folder names as potentially exposed and avoid putting sensitive information in folder titles or naming. 5) Audit user and knowledge base access grants after upgrading.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassFrameworkRAGAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0064- Gather RAG-Indexed Targets

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM08-Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-109287?

Is CVE-2026-109287 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-109287, increasing the risk of exploitation.

How to fix CVE-2026-109287?

1) Upgrade open-webui to 0.11.4 or later (pip install -U open-webui, or pull the patched container image). 2) Until patched, disable open self-registration and limit knowledge base read grants to trusted users. 3) Review reverse proxy or application logs for GET /api/v1/knowledge/{id}/files requests carrying a directory_id parameter that does not match the knowledge base, and for one account querying many different directory IDs. 4) Treat folder names as potentially exposed and avoid putting sensitive information in folder titles or naming. 5) Audit user and knowledge base access grants after upgrading.

What systems are affected by CVE-2026-109287?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, LLM chat web interfaces, Multi-tenant AI platforms, Knowledge base management.

What is the CVSS score for CVE-2026-109287?

CVE-2026-109287 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesLLM chat web interfacesMulti-tenant AI platformsKnowledge base management

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0064Gather RAG-Indexed Targets

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM08

What are the technical details?

Original Advisory

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.

Exploitation Scenario

An authenticated low-privilege user in a shared Open WebUI instance obtains a directory UUID belonging to another team's knowledge base, for example through a shared link, a log entry or a leaked reference. They call GET /api/v1/knowledge/{their_kb_id}/files?directory_id={foreign_uuid}. Because the server does not check that the directory belongs to the requested knowledge base, the response returns breadcrumbs with folder names, the owner user IDs and the knowledge base IDs of that directory and all its ancestors. The attacker uses this to map the other team's structure and identify high-value owners or knowledge bases to target with further attacks.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled Key CWE-863Incorrect Authorization

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.