CWE-862
Weakness Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Dimensions
- Behavior-Property: Missing
- Behavior-Type: Authorization
Mapping guidance
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit
Relationships and members
Modes of introduction
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Authorization weaknesses may arise when a single-user application is ported to a multi-user environment.
A developer may introduce authorization weaknesses because of a lack of understanding about the underlying technologies. For example, a developer may assume that attackers cannot modify certain inputs such as headers or cookies.
Detection methods
Automated Static Analysis
Automated static analysis is useful for detecting commonly-used idioms for authorization. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authorization libraries.
Generally, automated static analysis tools have difficulty detecting custom authorization schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an authorization check; an automated technique that detects the absence of authorization may report false positives.
Effectiveness: Limited
Automated Dynamic Analysis
Automated dynamic analysis may find many or all possible interfaces that do not require authorization, but manual analysis is required to determine if the lack of authorization violates business logic.
Manual Analysis
This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.
Specifically, manual static analysis is useful for evaluating the correctness of custom authorization mechanisms.
Effectiveness: Moderate
These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules. However, manual efforts might not achieve desired code coverage within limited time constraints.
Manual Static Analysis - Binary or Bytecode
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Effectiveness: SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Web Application Scanner
Web Services Scanner
Database Scanners
Effectiveness: SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Host Application Interface Scanner
Fuzz Tester
Framework-based Fuzzer
Effectiveness: SOAR Partial
Manual Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Focused Manual Spotcheck - Focused manual analysis of source
Manual Source Code Review (not inspections)
Effectiveness: SOAR Partial
Automated Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer
Effectiveness: SOAR Partial
Architecture or Design Review
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Formal Methods / Correct-By-Construction
Effectiveness: High
Notes
Terminology
Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
Content history
Suggested mappings to ISA/IEC 62443.
Provided diagram to improve CWE usability
updated Demonstrative_Examples, Related_Attack_Patterns, Relationships
updated Potential_Mitigations, References, Relationships
updated Demonstrative_Examples, Observed_Examples, References, Relationships
updated Potential_Mitigations
updated Relationships
updated Detection_Factors
updated Relationships
updated Applicable_Platforms, Modes_of_Introduction, References, Relationships
updated References
updated Relationships
updated Relationships
updated Relationships
updated Relationships
updated Alternate_Terms, Observed_Examples
updated Observed_Examples, Related_Attack_Patterns, Relationships
updated Relationships
updated Relationships
updated Observed_Examples
updated Description, Potential_Mitigations
updated References, Relationships, Taxonomy_Mappings
updated Mapping_Notes, Relationships, Taxonomy_Mappings
updated Common_Consequences, Description, Diagram, Relationships, Terminology_Notes
updated Applicable_Platforms, Detection_Factors, Observed_Examples, References
updated Applicable_Platforms, Relationships, Weakness_Ordinalities
updated Applicable_Platforms, Observed_Examples, Relationships
updated Applicable_Platforms, Dimensions, References, Relationships, Taxonomy_Mappings
19853 vulnerabilities reference this CWE, most recent first.
GHSA-7R6Q-QC26-XVXH
Vulnerability from github – Published: 2026-09-30 18:33 – Updated: 2026-09-30 18:33NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampering.
{
"affected": [],
"aliases": [
"CVE-2026-47580"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-30T16:17:27Z",
"severity": "HIGH"
},
"details": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampering.",
"id": "GHSA-7r6q-qc26-xvxh",
"modified": "2026-09-30T18:33:46Z",
"published": "2026-09-30T18:33:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47580"
},
{
"type": "WEB",
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5861"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47580"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7R7X-GJVR-448G
Vulnerability from github – Published: 2026-07-24 17:02 – Updated: 2026-07-24 17:02Open WebUI upload metadata can add files to knowledge bases without write permission
Summary
Open WebUI's file upload background processing trusts the client-supplied metadata.knowledge_id value and inserts a knowledge_file association before validating that the uploading user has write access to the target knowledge base.
A verified user with only read access to a knowledge base can upload an arbitrary file and set metadata={"knowledge_id":"<target knowledge id>"}. The normal /api/v1/knowledge/{id}/file/add endpoint correctly requires knowledge-base write access, but the upload auto-link path bypasses that authorization check.
The immediate result is unauthorized modification of the target knowledge base's file membership. The attached attacker-controlled file becomes visible through /api/v1/knowledge/{id}/files, and readers/owners of that knowledge base can retrieve the file through the normal file endpoints because file access is derived from KnowledgeFile membership.
Affected Version
- Repository:
open-webui/open-webui - Tested source commit:
02dc3e689ceac915a870b373318b99c029ddf603 - Package version observed in
package.json:0.9.6 - Package name:
open-webui
Impact
A read-only knowledge-base collaborator can perform a write operation against that knowledge base by attaching arbitrary uploaded files.
Security impact:
- Unauthorized knowledge-base membership modification.
- Integrity impact on shared knowledge-base file listings.
- Attacker-controlled files become readable to other users who can read the target knowledge base.
- If an owner/admin later reprocesses or globally reindexes the knowledge base, the unauthorized file can be indexed into the knowledge collection, turning the membership bypass into RAG/content poisoning.
This is not an unauthenticated issue. It requires a verified Open WebUI account and a valid target knowledge-base ID. The clearest exploit path is a user who legitimately has read access to a knowledge base but not write access.
Source Evidence
The normal single-file knowledge add endpoint checks write permission before processing or inserting the relationship:
backend/open_webui/routers/knowledge.pyadd_file_to_knowledge_by_id- Lines 714-728 reject callers who are not owner, admin, or granted
writeaccess. - Lines 750-766 then process and insert the file only after that authorization gate.
The upload auto-link path does not perform the same check:
backend/open_webui/routers/files.pyprocess_uploaded_file- Lines 178-186 read
knowledge_idfrom upload metadata and immediately callKnowledges.add_file_to_knowledge_by_id(...). - Lines 187-192 call
process_file(... collection_name=knowledge_id ...)after the insert.
The model method inserts the relationship without validating the caller's write access to the knowledge base:
backend/open_webui/models/knowledge.pyadd_file_to_knowledge_by_id- Lines 646-677 create and commit a
KnowledgeFilerow for the suppliedknowledge_id,file_id, anduser_id.
The later vector write check exists, but it runs too late:
backend/open_webui/routers/retrieval.pyprocess_file- Lines 1587-1592 call
_validate_collection_access(..., access_type='write')when a collection is supplied.
Because the unauthorized KnowledgeFile row is already committed before that check runs, the failed vector processing does not undo the knowledge-base file association. The upload code catches the exception at backend/open_webui/routers/files.py lines 194-195 and logs a warning while leaving the row in place.
The unauthorized relationship affects file access decisions:
backend/open_webui/utils/access_control/files.pyhas_access_to_file- Lines 41-53 grant file access when a file is associated with a knowledge base the user can access.
So once the attacker's file is inserted into the target KnowledgeFile table, target knowledge-base readers/owners can see and fetch that file through normal knowledge/file routes.
Reproduction Steps
Use a local Open WebUI instance with two verified users:
- As user
owner, create a knowledge base. - Grant user
readerread access to the knowledge base, but do not grant write access. - As
reader, confirm the normal add-file endpoint is blocked:
POST /api/v1/knowledge/<knowledge_id>/file/add
Authorization: Bearer <reader token>
Content-Type: application/json
{"file_id":"<reader-owned-file-id>"}
Expected and observed behavior for the normal route: it rejects the request because reader lacks knowledge-base write access.
- As
reader, upload a new file with the same target knowledge ID embedded in upload metadata:
POST /api/v1/files/?process=true&process_in_background=false
Authorization: Bearer <reader token>
Content-Type: multipart/form-data
file=@attacker-note.txt
metadata={"knowledge_id":"<knowledge_id>"}
- Observe that the upload request succeeds and returns the uploaded file record.
- As
owner, request the knowledge-base files:
GET /api/v1/knowledge/<knowledge_id>/files
Authorization: Bearer <owner token>
- Observe that
attacker-note.txtappears in the target knowledge base even thoughreaderdid not have write access. - As
owner, request the file content:
GET /api/v1/files/<attacker_file_id>/content
Authorization: Bearer <owner token>
- Observe that the file is retrievable because
has_access_to_filederives access from the unauthorized knowledge-base membership.
Expected Behavior
The upload auto-link path should enforce the same authorization contract as /api/v1/knowledge/{id}/file/add:
- The target knowledge base must exist.
- The caller must be the knowledge owner, an admin, or have
writeaccess. - The supplied
directory_id, if present, must belong to the target knowledge base. - The
KnowledgeFileassociation should only be inserted after authorization and processing succeed.
Actual Behavior
metadata.knowledge_id causes Knowledges.add_file_to_knowledge_by_id(...) to insert a KnowledgeFile row before write authorization is checked. The later collection write validation can fail, but the unauthorized membership row remains committed.
Suggested Fix
Move knowledge-base authorization before the insert in the upload auto-link path. The upload path should share the same write-access and directory validation logic used by the dedicated knowledge endpoints.
One safe pattern:
- Load the target knowledge base.
- Require owner/admin/write access before calling
Knowledges.add_file_to_knowledge_by_id. - Validate that
directory_id, if supplied, belongs to the same knowledge base. - Run vector processing before inserting the membership row, or wrap processing plus insertion in a transaction/compensating cleanup so a denied or failed process cannot leave a stale unauthorized row.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59217"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T17:02:14Z",
"nvd_published_at": "2026-07-09T17:17:02Z",
"severity": "MODERATE"
},
"details": "# Open WebUI upload metadata can add files to knowledge bases without write permission\n\n## Summary\n\nOpen WebUI\u0027s file upload background processing trusts the client-supplied `metadata.knowledge_id` value and inserts a `knowledge_file` association before validating that the uploading user has write access to the target knowledge base.\n\nA verified user with only read access to a knowledge base can upload an arbitrary file and set `metadata={\"knowledge_id\":\"\u003ctarget knowledge id\u003e\"}`. The normal `/api/v1/knowledge/{id}/file/add` endpoint correctly requires knowledge-base write access, but the upload auto-link path bypasses that authorization check.\n\nThe immediate result is unauthorized modification of the target knowledge base\u0027s file membership. The attached attacker-controlled file becomes visible through `/api/v1/knowledge/{id}/files`, and readers/owners of that knowledge base can retrieve the file through the normal file endpoints because file access is derived from `KnowledgeFile` membership.\n\n## Affected Version\n\n- Repository: `open-webui/open-webui`\n- Tested source commit: `02dc3e689ceac915a870b373318b99c029ddf603`\n- Package version observed in `package.json`: `0.9.6`\n- Package name: `open-webui`\n\n## Impact\n\nA read-only knowledge-base collaborator can perform a write operation against that knowledge base by attaching arbitrary uploaded files.\n\nSecurity impact:\n\n- Unauthorized knowledge-base membership modification.\n- Integrity impact on shared knowledge-base file listings.\n- Attacker-controlled files become readable to other users who can read the target knowledge base.\n- If an owner/admin later reprocesses or globally reindexes the knowledge base, the unauthorized file can be indexed into the knowledge collection, turning the membership bypass into RAG/content poisoning.\n\nThis is not an unauthenticated issue. It requires a verified Open WebUI account and a valid target knowledge-base ID. The clearest exploit path is a user who legitimately has read access to a knowledge base but not write access.\n\n## Source Evidence\n\nThe normal single-file knowledge add endpoint checks write permission before processing or inserting the relationship:\n\n- `backend/open_webui/routers/knowledge.py`\n- `add_file_to_knowledge_by_id`\n- Lines 714-728 reject callers who are not owner, admin, or granted `write` access.\n- Lines 750-766 then process and insert the file only after that authorization gate.\n\nThe upload auto-link path does not perform the same check:\n\n- `backend/open_webui/routers/files.py`\n- `process_uploaded_file`\n- Lines 178-186 read `knowledge_id` from upload metadata and immediately call `Knowledges.add_file_to_knowledge_by_id(...)`.\n- Lines 187-192 call `process_file(... collection_name=knowledge_id ...)` after the insert.\n\nThe model method inserts the relationship without validating the caller\u0027s write access to the knowledge base:\n\n- `backend/open_webui/models/knowledge.py`\n- `add_file_to_knowledge_by_id`\n- Lines 646-677 create and commit a `KnowledgeFile` row for the supplied `knowledge_id`, `file_id`, and `user_id`.\n\nThe later vector write check exists, but it runs too late:\n\n- `backend/open_webui/routers/retrieval.py`\n- `process_file`\n- Lines 1587-1592 call `_validate_collection_access(..., access_type=\u0027write\u0027)` when a collection is supplied.\n\nBecause the unauthorized `KnowledgeFile` row is already committed before that check runs, the failed vector processing does not undo the knowledge-base file association. The upload code catches the exception at `backend/open_webui/routers/files.py` lines 194-195 and logs a warning while leaving the row in place.\n\nThe unauthorized relationship affects file access decisions:\n\n- `backend/open_webui/utils/access_control/files.py`\n- `has_access_to_file`\n- Lines 41-53 grant file access when a file is associated with a knowledge base the user can access.\n\nSo once the attacker\u0027s file is inserted into the target `KnowledgeFile` table, target knowledge-base readers/owners can see and fetch that file through normal knowledge/file routes.\n\n## Reproduction Steps\n\nUse a local Open WebUI instance with two verified users:\n\n1. As user `owner`, create a knowledge base.\n2. Grant user `reader` read access to the knowledge base, but do not grant write access.\n3. As `reader`, confirm the normal add-file endpoint is blocked:\n\n```http\nPOST /api/v1/knowledge/\u003cknowledge_id\u003e/file/add\nAuthorization: Bearer \u003creader token\u003e\nContent-Type: application/json\n\n{\"file_id\":\"\u003creader-owned-file-id\u003e\"}\n```\n\nExpected and observed behavior for the normal route: it rejects the request because `reader` lacks knowledge-base write access.\n\n4. As `reader`, upload a new file with the same target knowledge ID embedded in upload metadata:\n\n```http\nPOST /api/v1/files/?process=true\u0026process_in_background=false\nAuthorization: Bearer \u003creader token\u003e\nContent-Type: multipart/form-data\n\nfile=@attacker-note.txt\nmetadata={\"knowledge_id\":\"\u003cknowledge_id\u003e\"}\n```\n\n5. Observe that the upload request succeeds and returns the uploaded file record.\n6. As `owner`, request the knowledge-base files:\n\n```http\nGET /api/v1/knowledge/\u003cknowledge_id\u003e/files\nAuthorization: Bearer \u003cowner token\u003e\n```\n\n7. Observe that `attacker-note.txt` appears in the target knowledge base even though `reader` did not have write access.\n8. As `owner`, request the file content:\n\n```http\nGET /api/v1/files/\u003cattacker_file_id\u003e/content\nAuthorization: Bearer \u003cowner token\u003e\n```\n\n9. Observe that the file is retrievable because `has_access_to_file` derives access from the unauthorized knowledge-base membership.\n\n## Expected Behavior\n\nThe upload auto-link path should enforce the same authorization contract as `/api/v1/knowledge/{id}/file/add`:\n\n- The target knowledge base must exist.\n- The caller must be the knowledge owner, an admin, or have `write` access.\n- The supplied `directory_id`, if present, must belong to the target knowledge base.\n- The `KnowledgeFile` association should only be inserted after authorization and processing succeed.\n\n## Actual Behavior\n\n`metadata.knowledge_id` causes `Knowledges.add_file_to_knowledge_by_id(...)` to insert a `KnowledgeFile` row before write authorization is checked. The later collection write validation can fail, but the unauthorized membership row remains committed.\n\n## Suggested Fix\n\nMove knowledge-base authorization before the insert in the upload auto-link path. The upload path should share the same write-access and directory validation logic used by the dedicated knowledge endpoints.\n\nOne safe pattern:\n\n1. Load the target knowledge base.\n2. Require owner/admin/write access before calling `Knowledges.add_file_to_knowledge_by_id`.\n3. Validate that `directory_id`, if supplied, belongs to the same knowledge base.\n4. Run vector processing before inserting the membership row, or wrap processing plus insertion in a transaction/compensating cleanup so a denied or failed process cannot leave a stale unauthorized row.",
"id": "GHSA-7r7x-gjvr-448g",
"modified": "2026-07-24T17:02:14Z",
"published": "2026-07-24T17:02:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-7r7x-gjvr-448g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59217"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/pull/26001"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/commit/b7626f05fb92b24ab923ad81a037071ebd5623d1"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)"
}
GHSA-7R82-QHG4-6WVJ
Vulnerability from github – Published: 2026-05-08 19:51 – Updated: 2026-05-15 23:52Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
Affected Component
Retrieval web/YouTube processing endpoints:
- backend/open_webui/routers/retrieval.py (lines 1810-1837, process_web)
- backend/open_webui/routers/retrieval.py (the parallel process_youtube endpoint)
- backend/open_webui/routers/retrieval.py (line 1445, save_docs_to_vector_db call chain)
Affected Versions
Current main branch (commit 6fdd19bf1) and likely all versions with RAG/knowledge base functionality.
Description
The POST /api/v1/retrieval/process/web endpoint accepts a user-supplied collection_name and an overwrite query parameter (default: True). It performs no authorization check on whether the calling user owns or has write access to the target collection. When overwrite=True, save_docs_to_vector_db calls VECTOR_DB_CLIENT.delete_collection() on the target collection before writing new content.
Combined with the knowledge base enumeration vulnerability (separate report), an attacker can trivially discover any user's knowledge base UUID and then destroy or poison it.
# retrieval.py:1810-1837 — no collection authorization check
@router.post('/process/web')
async def process_web(
request: Request,
form_data: ProcessUrlForm,
user=Depends(get_verified_user),
...
):
# ... fetch and process the URL ...
save_docs_to_vector_db(
request=request,
docs=docs,
collection_name=form_data.collection_name, # attacker-controlled, unchecked
overwrite=overwrite, # defaults to True
...
)
CVSS 3.1 Breakdown
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network (N) | Exploited remotely via API call |
| Attack Complexity | Low (L) | Single API call with a known KB UUID |
| Privileges Required | Low (L) | Requires any authenticated user account |
| User Interaction | None (N) | No victim interaction required |
| Scope | Unchanged (U) | Impact within the knowledge base authorization boundary |
| Confidentiality | None (N) | No data disclosure from this vulnerability directly |
| Integrity | High (H) | Complete replacement of victim's KB content with attacker-controlled data |
| Availability | High (H) | Victim's original KB embeddings are deleted; KB effectively destroyed |
Attack Scenario
- Attacker discovers victim's KB UUID via the
knowledge-basesmeta-collection (separate finding) or other enumeration. - Attacker sends:
POST /api/v1/retrieval/process/web?overwrite=true { "url": "https://attacker.com/poison", "collection_name": "<victim_kb_uuid>" } - The endpoint fetches content from the attacker's URL.
save_docs_to_vector_dbdeletes the entire vector collection belonging to the victim's knowledge base.- The attacker's fetched content is embedded and written as the new collection content.
- Victim's RAG queries against their KB now return attacker-controlled content instead of their original documents.
Impact
- Data destruction: Victim's original KB embeddings are permanently deleted from the vector store
- RAG poisoning: Attacker-controlled content replaces legitimate knowledge, causing the LLM to return misleading or malicious answers to the victim
- Indirect prompt injection: Poisoned content can contain crafted prompts that manipulate the victim's LLM behavior when queried
- Persistence: The poisoned content persists until the KB is rebuilt from source files
Preconditions
- Attacker must have a valid user account
- Attacker must know the target collection name (KB UUID) — easily obtained via the
knowledge-basesenumeration finding
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.12"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44554"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T19:51:14Z",
"nvd_published_at": "2026-05-15T20:16:46Z",
"severity": "HIGH"
},
"details": "# Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite\n\n## Affected Component\n\nRetrieval web/YouTube processing endpoints:\n- `backend/open_webui/routers/retrieval.py` (lines 1810-1837, `process_web`)\n- `backend/open_webui/routers/retrieval.py` (the parallel `process_youtube` endpoint)\n- `backend/open_webui/routers/retrieval.py` (line 1445, `save_docs_to_vector_db` call chain)\n\n## Affected Versions\n\nCurrent main branch (commit `6fdd19bf1`) and likely all versions with RAG/knowledge base functionality.\n\n## Description\n\nThe `POST /api/v1/retrieval/process/web` endpoint accepts a user-supplied `collection_name` and an `overwrite` query parameter (default: `True`). It performs no authorization check on whether the calling user owns or has write access to the target collection. When `overwrite=True`, `save_docs_to_vector_db` calls `VECTOR_DB_CLIENT.delete_collection()` on the target collection before writing new content.\n\nCombined with the knowledge base enumeration vulnerability (separate report), an attacker can trivially discover any user\u0027s knowledge base UUID and then destroy or poison it.\n\n```python\n# retrieval.py:1810-1837 \u2014 no collection authorization check\n@router.post(\u0027/process/web\u0027)\nasync def process_web(\n request: Request,\n form_data: ProcessUrlForm,\n user=Depends(get_verified_user),\n ...\n):\n # ... fetch and process the URL ...\n save_docs_to_vector_db(\n request=request,\n docs=docs,\n collection_name=form_data.collection_name, # attacker-controlled, unchecked\n overwrite=overwrite, # defaults to True\n ...\n )\n```\n\n## CVSS 3.1 Breakdown\n\n| Metric | Value | Rationale |\n|--------|-------|-----------|\n| Attack Vector | Network (N) | Exploited remotely via API call |\n| Attack Complexity | Low (L) | Single API call with a known KB UUID |\n| Privileges Required | Low (L) | Requires any authenticated user account |\n| User Interaction | None (N) | No victim interaction required |\n| Scope | Unchanged (U) | Impact within the knowledge base authorization boundary |\n| Confidentiality | None (N) | No data disclosure from this vulnerability directly |\n| Integrity | High (H) | Complete replacement of victim\u0027s KB content with attacker-controlled data |\n| Availability | High (H) | Victim\u0027s original KB embeddings are deleted; KB effectively destroyed |\n\n## Attack Scenario\n\n1. Attacker discovers victim\u0027s KB UUID via the `knowledge-bases` meta-collection (separate finding) or other enumeration.\n2. Attacker sends:\n ```\n POST /api/v1/retrieval/process/web?overwrite=true\n {\n \"url\": \"https://attacker.com/poison\",\n \"collection_name\": \"\u003cvictim_kb_uuid\u003e\"\n }\n ```\n3. The endpoint fetches content from the attacker\u0027s URL.\n4. `save_docs_to_vector_db` deletes the entire vector collection belonging to the victim\u0027s knowledge base.\n5. The attacker\u0027s fetched content is embedded and written as the new collection content.\n6. Victim\u0027s RAG queries against their KB now return attacker-controlled content instead of their original documents.\n\n## Impact\n\n- **Data destruction:** Victim\u0027s original KB embeddings are permanently deleted from the vector store\n- **RAG poisoning:** Attacker-controlled content replaces legitimate knowledge, causing the LLM to return misleading or malicious answers to the victim\n- **Indirect prompt injection:** Poisoned content can contain crafted prompts that manipulate the victim\u0027s LLM behavior when queried\n- **Persistence:** The poisoned content persists until the KB is rebuilt from source files\n\n## Preconditions\n\n- Attacker must have a valid user account\n- Attacker must know the target collection name (KB UUID) \u2014 easily obtained via the `knowledge-bases` enumeration finding",
"id": "GHSA-7r82-qhg4-6wvj",
"modified": "2026-05-15T23:52:48Z",
"published": "2026-05-08T19:51:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-7r82-qhg4-6wvj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44554"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite"
}
GHSA-7R9P-F462-32JP
Vulnerability from github – Published: 2025-09-26 09:31 – Updated: 2026-04-01 18:36Missing Authorization vulnerability in wpshuffle Subscribe To Unlock allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Subscribe To Unlock: from n/a through 1.1.5.
{
"affected": [],
"aliases": [
"CVE-2025-60152"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-26T09:15:43Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in wpshuffle Subscribe To Unlock allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Subscribe To Unlock: from n/a through 1.1.5.",
"id": "GHSA-7r9p-f462-32jp",
"modified": "2026-04-01T18:36:22Z",
"published": "2025-09-26T09:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60152"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/subscribe-to-unlock/vulnerability/wordpress-subscribe-to-unlock-plugin-1-1-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7R9Q-GVQQ-999J
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session.
{
"affected": [],
"aliases": [
"CVE-2026-76211"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T14:17:46Z",
"severity": "MODERATE"
},
"details": "phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session.",
"id": "GHSA-7r9q-gvqq-999j",
"modified": "2026-08-19T15:32:33Z",
"published": "2026-08-19T15:32:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7gh7-qh7c-9r8m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76211"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/phpmyfaq-before-information-disclosure-via-admin-api"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7RCX-JJ9Q-R3RJ
Vulnerability from github – Published: 2023-09-04 03:30 – Updated: 2024-04-04 07:23In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
{
"affected": [],
"aliases": [
"CVE-2023-38441"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-04T02:15:08Z",
"severity": "MODERATE"
},
"details": "In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges",
"id": "GHSA-7rcx-jj9q-r3rj",
"modified": "2024-04-04T07:23:20Z",
"published": "2023-09-04T03:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38441"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7RFW-95JM-3H4C
Vulnerability from github – Published: 2025-09-22 21:30 – Updated: 2026-04-06 15:31Missing Authorization vulnerability in WPXPO WowAddons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WowAddons: from n/a through 1.0.17.
{
"affected": [],
"aliases": [
"CVE-2025-57958"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-22T19:15:54Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in WPXPO WowAddons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WowAddons: from n/a through 1.0.17.",
"id": "GHSA-7rfw-95jm-3h4c",
"modified": "2026-04-06T15:31:22Z",
"published": "2025-09-22T21:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57958"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/product-addons/vulnerability/wordpress-wowaddons-plugin-1-0-17-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7RFW-QH9G-VG98
Vulnerability from github – Published: 2023-02-27 15:30 – Updated: 2023-03-07 18:30A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API.
{
"affected": [],
"aliases": [
"CVE-2023-27264"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-27T15:15:00Z",
"severity": "MODERATE"
},
"details": "A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API.",
"id": "GHSA-7rfw-qh9g-vg98",
"modified": "2023-03-07T18:30:39Z",
"published": "2023-02-27T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27264"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7RGC-R95X-R2M3
Vulnerability from github – Published: 2025-11-26 18:31 – Updated: 2025-12-03 21:31Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java.
{
"affected": [],
"aliases": [
"CVE-2025-46175"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-26T17:15:45Z",
"severity": "HIGH"
},
"details": "Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java.",
"id": "GHSA-7rgc-r95x-r2m3",
"modified": "2025-12-03T21:31:02Z",
"published": "2025-11-26T18:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46175"
},
{
"type": "WEB",
"url": "https://gist.github.com/Han-tj/74d2ed84ede1909da55090fed410d288"
},
{
"type": "WEB",
"url": "https://gitee.com/y_project/RuoYi/commit/f935b2782f4237cdbcc13bdce76703e82c42f4fe"
},
{
"type": "WEB",
"url": "https://gitee.com/y_project/RuoYi/issues/IC1FS0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7RGQ-5GWV-QV9H
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31Missing Authorization vulnerability in WPClever WPC Product Bundles for WooCommerce woo-product-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Product Bundles for WooCommerce: from n/a through <= 8.4.5.
{
"affected": [],
"aliases": [
"CVE-2026-32406"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:54:57Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in WPClever WPC Product Bundles for WooCommerce woo-product-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Product Bundles for WooCommerce: from n/a through \u003c= 8.4.5.",
"id": "GHSA-7rgq-5gwv-qv9h",
"modified": "2026-03-13T21:31:49Z",
"published": "2026-03-13T21:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32406"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/woo-product-bundle/vulnerability/wordpress-wpc-product-bundles-for-woocommerce-plugin-8-4-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.