Open WebUI CVE-2026-109285

Exploitation requires the attacker to be a FORMER collaborator on a specific Open WebUI knowledge base who previously held read or write grants and was subsequently removed, but whose access survives through a stale cached knowledge base reference evaluated by has_access_to_file (reflected as AT:P in the CVSS vector). The attacker must be an authenticated application user (PR:L) and must target knowledge bases they once had access to. Limiting factors: no path exists for a never-authorized or unauthenticated outsider; the flaw only manifests after a share-then-revoke lifecycle, so single-owner or never-shared knowledge bases are unaffected, and impact is confined to downloading or deleting files within the Open WebUI application.

This is a genuinely low-priority issue despite the 'Authentication Bypass' tag. The vendor-issued CVSS 4.0 base score is 2.3 (Low), and every signal agrees it is minor: the vector is AV:N/AC:L but carries AT:P, meaning a specific attack requirement must hold - the attacker must be a FORMER knowledge base collaborator whose access was revoked but whose stale cached reference persists. PR:L confirms the attacker must already be an authenticated application user, and impact is uniformly Low (VC:L/VI:L/VA:L) with no scope change (SC/SI/SA:N). No EPSS score, SSVC decision, or KEV listing was provided, and there is no public exploit indicator, so exploitation is 'no public exploit identified at time of analysis.' There is no signal conflict to flag; rather, all signals converge on a low-severity, insider/ex-collaborator authorization flaw (CWE-863) rather than a widely weaponizable remote vulnerability. The practical risk is bounded to environments that previously shared knowledge bases with users who were later removed - a targeted, trust-relationship-dependent scenario rather than mass exploitation.

A user is granted read or write access to a shared knowledge base in Open WebUI and later has that access revoked, but a stale cached knowledge base reference leaves has_access_to_file still granting them rights. The former collaborator then calls the file content endpoint to download files that were removed, or issues delete requests, affecting even the owner's private knowledge bases. No public exploit code was identified, so exploitation would require an attacker to manually leverage their prior-collaborator session.