Most recent entries from all

bdu:2026-09666

2026-10-18T11:45:55.109028+00:00

bdu:2026-09666

EUVD-2026-319085

2026-10-18T11:45:55.109062+00:00

EUVD-2026-319085

fkie_cve-2026-44554

2026-10-18T11:45:55.109083+00:00

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/retrieval/process/web endpoint accepts a user-supplied collection_name and an overwrite query parameter (default: True). It performs no authorization check on whether the calling user owns or has write access to the target collection. When overwrite=True, save_docs_to_vector_db calls VECTOR_DB_CLIENT.delete_collection() on the target collection before writing new content. This vulnerability is fixed in 0.9.0.

GHSA-7r82-qhg4-6wvj — Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

2026-10-18T11:45:55.109141+00:00

Affected: PyPI: open-webui

# Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

## Affected Component

Retrieval web/YouTube processing endpoints: - `backend/open_webui/routers/retrieval.py` (lines 1810-1837, `process_web`) - `backend/open_webui/routers/retrieval.py` (the parallel `process_youtube` endpoint) - `backend/open_webui/routers/retrieval.py` (line 1445, `save_docs_to_vector_db` call chain)

## Affected Versions

Current main branch (commit `6fdd19bf1`) and likely all versions with RAG/knowledge base functionality.

## Description

The `POST /api/v1/retrieval/process/web` endpoint accepts a user-supplied `collection_name` and an `overwrite` query parameter (default: `True`). It performs no authorization check on whether the calling user owns or has write access to the target collection. When `overwrite=True`, `save_docs_to_vector_db` calls `VECTOR_DB_CLIENT.delete_collection()` on the target collection before writing new content.

Combined with the knowledge base enumeration vulnerability (separate report), an attacker can trivially discover any user's knowledge base UUID and then destroy or poison it.

```python # retrieval.py:1810-1837 — no collection authorization check @router.post('/process/web') async def process_web( request: Request, form_data: ProcessUrlForm, user=Depends(get_verified_user), ... ): # ... fetch and process the URL ... save_docs_to_vector_db( request=request, docs=docs, collection_name=for…

PYSEC-2026-2710 — Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite