7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54012

CVE-2026-54012: Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats meta.knowledge entries of type file as an authorization source in two places: the built-in view_file tool reads the file's extracted text, and has_access_to_file()'s model branch authorizes the file content and file delete endpoints. A malicious model owner can therefore attach another user's file ID to their model metadata and read or delete that private file. This vulnerability is fixed in 0.9.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54012

CVE-2026-54012:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	<= 0.9.5	0.9.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from a critical lack of input validation on the meta.knowledge field for workspace models. An authenticated user with permissions to create or edit models can associate an arbitrary file ID with a model, even if they do not own or have access to that file. The application fails to verify this association at the time of creation, update, or import.

This unvalidated metadata is then improperly trusted as an authorization credential in other parts of the system. The has_access_to_file function, which governs access to file read and delete operations, will grant access if a file is referenced in any of the user's models' meta.knowledge. Similarly, the view_file built-in tool contains a bypass that allows file content to be read if the file ID is present in the model's knowledge.

An attacker can therefore perform the following actions on a victim's private file after obtaining its ID:

Create a model with a forged meta.knowledge entry pointing to the victim's file ID.
Use the view_file tool with this model to read the file's extracted text.
Call the file content API (GET /api/v1/files/{id}/content) to read the full file content.
Call the file deletion API (DELETE /api/v1/files/{id}) to delete the file.

The fix involves adding strict validation on all model write paths (create, update, import) to ensure the user has legitimate 'read' access to any file ID before it can be added to meta.knowledge.

Vulnerable functions

Models.insert_new_model

backend/open_webui/models/models.py

This class method is the primary entry point for the vulnerability. It persists a new model to the database using user-provided data (`form_data`). It fails to validate the `meta.knowledge` field within the form data, allowing an attacker to save a model that references a file ID they do not own. This stored malicious data is the foundation for the subsequent unauthorized access.

view_file

backend/open_webui/tools/builtin.py

This built-in tool function contains an authorization flaw. It bypasses standard file access checks (`has_access_to_file`) if the requested `file_id` is present in the `__model_knowledge__` list. An attacker can invoke a chat with a model containing forged `meta.knowledge` (which becomes `__model_knowledge__`), allowing them to use this tool to read the content of a victim's private file.

has_access_to_file

backend/open_webui/utils/access_control/files.py

This function is a central part of the file access control system and is used by API endpoints for reading and deleting files. It incorrectly trusts the `meta.knowledge` of a user's models as a valid source of authorization. If an attacker has a model with a forged reference to a victim's file, this function will return `True`, granting the attacker read and delete access to that file through the respective API endpoints. The check does not consider the requested `access_type` ('read' or 'write'), escalating the privilege.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.