CVE-2026-54010

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach arbitrary file_id values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, has_access_to_file() treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file. This vulnerability is fixed in 0.9.6.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/open-webui/open-webui/security/advisories/GHSA-vrhc-3fr6-pc3c	Exploit Vendor Advisory Mitigation
https://github.com/open-webui/open-webui/security/advisories/GHSA-vrhc-3fr6-pc3c	Exploit Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

History

25 Jun 2026, 13:34

Type	Values Removed	Values Added
CPE		cpe:2.3:a:openwebui:open_webui::::::::
First Time		Openwebui open Webui Openwebui
References	~~() https://github.com/open-webui/open-webui/security/advisories/GHSA-vrhc-3fr6-pc3c -~~	() https://github.com/open-webui/open-webui/security/advisories/GHSA-vrhc-3fr6-pc3c - Exploit, Vendor Advisory, Mitigation

23 Jun 2026, 18:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-23 18:18

Updated : 2026-06-25 13:34

NVD link : CVE-2026-54010

Mitre link : CVE-2026-54010

CVE.ORG link : CVE-2026-54010

JSON object : View

Products Affected

openwebui

open_webui

CWE

CWE-284

Improper Access Control

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-54010", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54010", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-23T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-webui", "product": "open-webui", "versions": [{"status": "affected", "version": "< 0.9.6"}]}]}], "published": "2026-06-23T18:18:06.180", "references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-vrhc-3fr6-pc3c", "tags": ["Exploit", "Vendor Advisory", "Mitigation"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-vrhc-3fr6-pc3c", "tags": ["Exploit", "Vendor Advisory", "Mitigation"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach arbitrary file_id values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, has_access_to_file() treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file. This vulnerability is fixed in 0.9.6."}], "lastModified": "2026-06-25T13:34:24.740", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAB89FE0-6F34-4624-ABED-8DEE4783A17D", "versionEndExcluding": "0.9.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}