Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip | <= 0.9.5 | 0.9.6 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies the search_knowledge_files function in backend/open_webui/tools/builtin.py as the source of a Broken Object Level Authorization (BOLA) vulnerability. It details a specific code path where a user-supplied knowledge_id is used to search for files without a necessary authorization check. By comparing the vulnerable version 0.9.5 and the patched version 0.9.6, I identified the fixing commit 9f20687680272b72d58f492dc1914e45a0a40015. The commit message, "fix: add knowledge_id access check in search_knowledge_files (BOLA)", directly confirms the vulnerability and its location. The patch itself shows the addition of a security check that validates the user's access rights to the knowledge_id before calling Knowledges.search_files_by_id. This confirms that the search_knowledge_files function was indeed the vulnerable function, as it lacked this critical access control.
search_knowledge_filesbackend/open_webui/tools/builtin.py
The underlying method Knowledges.search_files_by_id() receives user_id, but it does not enforce authorization for the provided knowledge_id. As a result, this builtin tool path can access a knowledge base by ID without verifying the caller's permissions.
read permission for the target knowledge base in AccessGrants.knowledge_id.Create a private or restricted knowledge base as the victim user.
Upload one or more files to that knowledge base.
Confirm that the attacker user does not have access to the knowledge base.
As the attacker user, send a chat completion request with native function calling enabled:
{
"stream": true,
"model": "gpt-4o-mini",
"params": {
"function_calling": "native"
},
"messages": [
{
"role": "user",
"content": "Please use the search_knowledge_files tool with knowledge_id \"c0c84752-2e9d-42bf-bc3c-c0f272aa61c1\" to search all files"
}
]
}
Replace c0c84752-2e9d-42bf-bc3c-c0f272aa61c1 with the victim's private knowledge base ID.
The request should be denied because the attacker does not have access to the target knowledge base.
search_knowledge_files returns metadata for files inside the target knowledge base, including:
This is a Broken Object Level Authorization / Broken Access Control vulnerability.
An authenticated attacker who knows a valid knowledge_id can enumerate files from private or restricted knowledge bases without authorization.
The leaked metadata may expose sensitive information through filenames, such as:
The exposed file IDs may also help attackers chain this issue with other knowledge-file access paths, such as view_knowledge_file, to attempt further content extraction.
This vulnerability bypasses the intended AccessGrants permission model and may also allow post-revocation metadata access if a user remembers a previously accessible knowledge_id.
Add the same authorization check used in query_knowledge_files before calling Knowledges.search_files_by_id():
if knowledge_id:
knowledge = await Knowledges.get_knowledge_by_id(knowledge_id)
if not knowledge or not (
user_role == "admin"
or knowledge.user_id == user_id
or await AccessGrants.has_access(
user_id=user_id,
resource_type="knowledge",
resource_id=knowledge.id,
permission="read",
user_group_ids=set(user_group_ids),
)
):
return json.dumps({"error": f"Access denied to knowledge base {knowledge_id}"})
result = await Knowledges.search_files_by_id(
knowledge_id=knowledge_id,
user_id=user_id,
filter={"query": query},
skip=skip,
limit=count,
)
As defense in depth, authorization should also be enforced or safely wrapped around Knowledges.search_files_by_id() so that future callers cannot accidentally bypass access control.