https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 21:26:29 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44557 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the _validate_collection_access function uses an incomplete allowlist that only enforces ownership checks for collections matching user-memory-* and file-* patterns. All other collection names pass through unchecked — including the system-level knowledge-bases meta-collection, which stores the IDs, names, and descriptions of every knowledge base on the instance. Any authenticated user can query this meta-collection directly via the retrieval query endpoints to obtain a global index of all knowledge bases across all users. This vulnerability is fixed in 0.9.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the _validate_collection_access function uses an incomplete allowlist that only enforces ownership checks for collections matching user-memory-* and file-* patterns. All other collection names pass through unchecked — including the system-level knowledge-bases meta-collection, which stores the IDs, names, and descriptions of every knowledge base on the instance. Any authenticated user can query this meta-collection directly via the retrieval query endpoints to obtain a global index of all knowledge bases across all users. This vulnerability is fixed in 0.9.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-44557 https://cve.radiocsirt.org/vuln/pysec-2026-2707 <p><strong>Affected:</strong> PyPI: open-webui</p> <p># Global Knowledge Base Enumeration via knowledge-bases Meta-Collection</p> <p>## Affected Component</p> <p>Retrieval collection access validation: - `backend/open_webui/routers/retrieval.py` (lines 2330-2355, `_validate_collection_access`) - `backend/open_webui/routers/retrieval.py` (query endpoints, e.g. `POST /query/doc`)</p> <p>## Affected Versions</p> <p>Current main branch (commit `6fdd19bf1`) and likely all versions with the knowledge base subsystem.</p> <p>## Description</p> <p>The `_validate_collection_access` function uses an incomplete allowlist that only enforces ownership checks for collections matching `user-memory-*` and `file-*` patterns. All other collection names pass through unchecked — including the system-level `knowledge-bases` meta-collection, which stores the IDs, names, and descriptions of every knowledge base on the instance.</p> <p>Any authenticated user can query this meta-collection directly via the retrieval query endpoints to obtain a global index of all knowledge bases across all users.</p> <p>```python # retrieval.py:2330-2355 — incomplete collection allowlist def _validate_collection_access(user, collection_name, ...): if collection_name.startswith(&#39;user-memory-&#39;): # Check user-memory ownership ... elif collection_name.startswith(&#39;file-&#39;): # Check file access ... # Everything else (including &#34;knowledge-bases&#34;) passes through unchecked ```</p> <p>This finding is the enabler for the KB destruction (`process/web`), KB content injection (`process/file`),…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p># Global Knowledge Base Enumeration via knowledge-bases Meta-Collection</p> <p>## Affected Component</p> <p>Retrieval collection access validation: - `backend/open_webui/routers/retrieval.py` (lines 2330-2355, `_validate_collection_access`) - `backend/open_webui/routers/retrieval.py` (query endpoints, e.g. `POST /query/doc`)</p> <p>## Affected Versions</p> <p>Current main branch (commit `6fdd19bf1`) and likely all versions with the knowledge base subsystem.</p> <p>## Description</p> <p>The `_validate_collection_access` function uses an incomplete allowlist that only enforces ownership checks for collections matching `user-memory-*` and `file-*` patterns. All other collection names pass through unchecked — including the system-level `knowledge-bases` meta-collection, which stores the IDs, names, and descriptions of every knowledge base on the instance.</p> <p>Any authenticated user can query this meta-collection directly via the retrieval query endpoints to obtain a global index of all knowledge bases across all users.</p> <p>```python # retrieval.py:2330-2355 — incomplete collection allowlist def _validate_collection_access(user, collection_name, ...): if collection_name.startswith(&#39;user-memory-&#39;): # Check user-memory ownership ... elif collection_name.startswith(&#39;file-&#39;): # Check file access ... # Everything else (including &#34;knowledge-bases&#34;) passes through unchecked ```</p> <p>This finding is the enabler for the KB destruction (`process/web`), KB content injection (`process/file`),…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2707