4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54016

CVE-2026-54016: Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI has a Broken Object Level Authorization (BOLA) vulnerability in the builtin search_knowledge_files tool. When native function calling is enabled and the selected model has no attached knowledge bases, an authenticated user can call search_knowledge_files with an arbitrary knowledge_id. The function then returns file metadata from that knowledge base without checking whether the user has read access. This allows unauthorized enumeration of private or restricted knowledge base files. This vulnerability is fixed in 0.9.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54016

CVE-2026-54016:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	<= 0.9.5	0.9.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly identifies the search_knowledge_files function in backend/open_webui/tools/builtin.py as the source of a Broken Object Level Authorization (BOLA) vulnerability. It details a specific code path where a user-supplied knowledge_id is used to search for files without a necessary authorization check. By comparing the vulnerable version 0.9.5 and the patched version 0.9.6, I identified the fixing commit 9f20687680272b72d58f492dc1914e45a0a40015. The commit message, "fix: add knowledge_id access check in search_knowledge_files (BOLA)", directly confirms the vulnerability and its location. The patch itself shows the addition of a security check that validates the user's access rights to the knowledge_id before calling Knowledges.search_files_by_id. This confirms that the search_knowledge_files function was indeed the vulnerable function, as it lacked this critical access control.

Vulnerable functions

search_knowledge_files

backend/open_webui/tools/builtin.py

The function `search_knowledge_files` is vulnerable to a Broken Object Level Authorization (BOLA) attack. When a user provides a `knowledge_id` and the model has no attached knowledge bases, the function proceeds to call `Knowledges.search_files_by_id` without verifying if the user has read access to the specified knowledge base. This allows any authenticated user to enumerate files within a private or restricted knowledge base if they know its ID. The patch mitigates this by adding an explicit authorization check to verify the user's permissions (admin, owner, or granted read access) before performing the search.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.