Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as legacy/ephemeral collections. In Milvus multitenancy mode, that user-controlled collection name becomes a resource_id and is interpolated into a Milvus expression without escaping. This is caused by an incomplete fix for CVE-2026-44560 This vulnerability is fixed in 0.9.6.

Affected: PyPI: open-webui

# RAG ACL Bypass in Milvus Multitenancy Mode

## Summary

This is a bypass of the fix for:

- GHSA-h36f-rqpx-j5wx - CVE-2026-44560 - "Unauthorized File and Knowledge Base Content Access via RAG Vector Search"

Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as legacy/ephemeral collections. In Milvus multitenancy mode, that user-controlled collection name becomes a `resource_id` and is interpolated into a Milvus expression without escaping.

An authenticated non-admin user can query:

```text x' or resource_id != '' or resource_id == 'x ```

This passes the Open WebUI ACL as an unknown collection, but Milvus evaluates:

```text resource_id == 'x' or resource_id != '' or resource_id == 'x' ```

That returns private knowledge-base chunks belonging to other users.

## Affected Configuration

Tested on:

```text Open WebUI: v0.9.5, commit 3660bc00f VECTOR_DB=milvus ENABLE_MILVUS_MULTITENANCY_MODE=true ```

This is **not a default-vector-store issue**. It affects **production deployments using Milvus multitenancy.**

## Impact

An authenticated low-privilege user can read private RAG / knowledge-base content they do not have access to. No victim interaction is required.

## Root Cause

ACL permits unknown collection names:

```python # backend/open_webui/retrieval/utils.py elif not await Knowledges.get_knowledge_by_id(name): validated.add(name) ```

Milvus…

Affected: PyPI: open-webui

# RAG ACL Bypass in Milvus Multitenancy Mode

## Summary

This is a bypass of the fix for:

- GHSA-h36f-rqpx-j5wx - CVE-2026-44560 - "Unauthorized File and Knowledge Base Content Access via RAG Vector Search"

Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as legacy/ephemeral collections. In Milvus multitenancy mode, that user-controlled collection name becomes a `resource_id` and is interpolated into a Milvus expression without escaping.

An authenticated non-admin user can query:

```text x' or resource_id != '' or resource_id == 'x ```

This passes the Open WebUI ACL as an unknown collection, but Milvus evaluates:

```text resource_id == 'x' or resource_id != '' or resource_id == 'x' ```

That returns private knowledge-base chunks belonging to other users.

## Affected Configuration

Tested on:

```text Open WebUI: v0.9.5, commit 3660bc00f VECTOR_DB=milvus ENABLE_MILVUS_MULTITENANCY_MODE=true ```

This is **not a default-vector-store issue**. It affects **production deployments using Milvus multitenancy.**

## Impact

An authenticated low-privilege user can read private RAG / knowledge-base content they do not have access to. No victim interaction is required.

## Root Cause

ACL permits unknown collection names:

```python # backend/open_webui/retrieval/utils.py elif not await Knowledges.get_knowledge_by_id(name): validated.add(name) ```

Milvus…