CVE-2026-45301CWE-284

Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

High · published May 15, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-05-15T21:19Z
EPSS history
Timeline
  • 15 MAY 21:19Z
    Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
    cvelistv5