https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T20:34:28.081374+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-44557 CVE-2026-44557 — Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection 2026-10-14T20:34:28.130448+00:00

Affected: open-webui

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the _validate_collection_access function uses an incomplete allowlist that only enforces ownership checks for collections matching user-memory-* and file-* patterns. All other collection names pass through unchecked — including the system-level knowledge-bases meta-collection, which stores the IDs, names, and descriptions of every knowledge base on the instance. Any authenticated user can query this meta-collection directly via the retrieval query endpoints to obtain a global index of all knowledge bases across all users. This vulnerability is fixed in 0.9.0.

 https://cve.radiocsirt.org/vuln/pysec-2026-2707 PYSEC-2026-2707 — Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection 2026-10-14T20:34:28.130520+00:00

Affected: PyPI: open-webui

# Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

## Affected Component

Retrieval collection access validation: - `backend/open_webui/routers/retrieval.py` (lines 2330-2355, `_validate_collection_access`) - `backend/open_webui/routers/retrieval.py` (query endpoints, e.g. `POST /query/doc`)

## Affected Versions

Current main branch (commit `6fdd19bf1`) and likely all versions with the knowledge base subsystem.

## Description

The `_validate_collection_access` function uses an incomplete allowlist that only enforces ownership checks for collections matching `user-memory-*` and `file-*` patterns. All other collection names pass through unchecked — including the system-level `knowledge-bases` meta-collection, which stores the IDs, names, and descriptions of every knowledge base on the instance.

Any authenticated user can query this meta-collection directly via the retrieval query endpoints to obtain a global index of all knowledge bases across all users.

```python # retrieval.py:2330-2355 — incomplete collection allowlist def _validate_collection_access(user, collection_name, ...): if collection_name.startswith('user-memory-'): # Check user-memory ownership ... elif collection_name.startswith('file-'): # Check file access ... # Everything else (including "knowledge-bases") passes through unchecked ```

This finding is the enabler for the KB destruction (`process/web`), KB content injection (`process/file`),…