Open WebUI EUVD-2026-97589

Requires an authenticated Open WebUI account (PR:L) that already holds read access to at least one knowledge base, plus possession of a valid foreign directory UUID - the advisory notes these are 'retained' UUIDs, so the attacker must have previously observed or otherwise obtained the target directory's UUID (they are not sequential/guessable identifiers). Affected deployments are Open WebUI versions 0.9.6 up to but not including 0.11.4. Limiting factors: valid credentials are mandatory (no anonymous access), the attack only yields directory/ownership metadata rather than file contents, and the attacker needs a usable foreign directory UUID; these constraints make it an authenticated tenant-to-tenant metadata leak rather than a remote unauthenticated exposure.

All signals point to a genuine-but-low-priority issue rather than an urgent one. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium) and is internally consistent with the description: network-reachable, low attack complexity, but requiring low-level authentication (PR:L) and yielding only limited confidentiality impact (VC:L) with no integrity or availability effect - matching CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The impact is a metadata/information-disclosure leak (folder names, owner user ids, knowledge-base ids of a directory and its ancestors), not data exfiltration of file contents or code execution, which further bounds real-world risk. Net: a legitimately authenticated tenant can enumerate structural metadata belonging to other users' knowledge bases - a real access-control defect worth patching, but not a drop-everything priority absent exploitation signals.

A low-privileged but authenticated Open WebUI user who has read access to any knowledge base reuses a foreign directory UUID (retained from a prior interaction or guessed/obtained elsewhere) and calls GET /api/v1/knowledge/{id}/files. The returned breadcrumbs disclose the folder names, owner user ids, and knowledge-base ids of that directory and all of its ancestors, letting the attacker map other tenants' knowledge-base structure and ownership. No public exploit code was identified in the provided data, and exploitation requires a valid authenticated session (PR:L).