CyberRota Analysis
AI-GeneratedThe Open WebUI platform versions prior to 0.10.0 are vulnerable due to improper access control in the _verify_knowledge_file_access function, which only verifies read access but allows users with read-only permissions to perform write or delete operations on knowledge files. This flaw could lead to unauthorized modifications or deletions of critical data, posing a risk to data integrity. Organizations using affected versions should prioritize upgrading to version 0.10.0 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_knowledge_file_access only checked read access while file write and delete routes later trusted object-derived access through writable model meta.knowledge entries, allowing a user with read-only knowledge file access to upgrade to file write or delete operations. This issue is fixed in version 0.10.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)