Vulnerability details
CVE-2026-45301
open-webui open-webui
Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
CVSS 3.1
8.1High
Official description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| open-webui | open-webui | < 0.3.16 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/open-webui/open-webui/security/advisories/GHSA-r8wh-8m7r-fh33 x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-16
- Last updated
- 2026-05-19
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.27%
Probability of exploitation in 30 days
19.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-284Improper Access Control