{"items":[{"id":"NVI-00016229","kind":"vulnerability","title":"Open WebUI: Forged chat-file link allows cross-user file read and deletion","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-vrhc-3fr6-pc3c","CVE-2026-54010"],"plain_summary":"GitHub lists this reviewed advisory for open-webui. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-069396377b2179fa6170d0fedd78ab99"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:04:20.000Z","value":"8.3 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4f9ed83ea666ad9420ca80dbe1a6a665"},{"kind":"CVSS","as_of":"2026-06-25T13:34:24.740Z","value":"8.3 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-069396377b2179fa6170d0fedd78ab99"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4f9ed83ea666ad9420ca80dbe1a6a665","url":"https://github.com/advisories/GHSA-vrhc-3fr6-pc3c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vrhc-3fr6-pc3c","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:47:44.783Z"},{"id":"sr-069396377b2179fa6170d0fedd78ab99","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54010","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-54010","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:12.360Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4f9ed83ea666ad9420ca80dbe1a6a665"],"technology":"open-webui","known_exclusions":[],"conditions_summary":"## Summary\n\nOpen WebUI `v0.9.5` lets an authenticated user attach arbitrary `file_id` values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, `has_access_to_file()` treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file.\n\n## Impact\n\nSecurity boundary crossed: file confidentiality and integrity.\n\nAn authenticated attacker who knows or obtains a victim `file_id` can make Open WebUI authorize, through an attacker-owned shared chat:\n\n- reading the victim file via `GET /api/v1/files/{id}/content`, and\n- deleting the victim file via `DELETE /api/v1/files/{id}`.\n\n## Root Cause\n\nClient-controlled message file IDs are persisted without file authorization checks:\n\n```python\n# backend/open_webui/main.py\nawait Chats.insert_chat_files(\n    chat_id,\n    user_message.get('id'),\n    [\n        file_item.get('id')\n        for file_item in user_message_files\n        if file_item.get('type') == 'file'\n    ],\n    user.id,\n)\n```\n\n`insert_chat_files()` stores the provided IDs directly:\n\n```python\n# backend/open_webui/models/chats.py\nChat","public_affected_ranges":["<= 0.9.5"]}],"null_published_at":"2026-11-08T19:53:44.018Z","source_updated_at":"2026-07-20T21:04:20.000Z","source_disclosed_at":"2026-06-17T14:12:20.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-04T02:47:44.783Z"},{"id":"NVI-00016229","kind":"vulnerability","title":"Open WebUI: Forged chat-file link allows cross-user file read and deletion","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vrhc-3fr6-pc3c","CVE-2026-54010"],"plain_summary":"GitHub lists this reviewed advisory for open-webui. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4f9ed83ea666ad9420ca80dbe1a6a665"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:04:20.000Z","value":"8.3 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4f9ed83ea666ad9420ca80dbe1a6a665"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4f9ed83ea666ad9420ca80dbe1a6a665","url":"https://github.com/advisories/GHSA-vrhc-3fr6-pc3c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vrhc-3fr6-pc3c","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:47:44.783Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4f9ed83ea666ad9420ca80dbe1a6a665"],"technology":"open-webui","known_exclusions":[],"conditions_summary":"## Summary\n\nOpen WebUI `v0.9.5` lets an authenticated user attach arbitrary `file_id` values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, `has_access_to_file()` treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file.\n\n## Impact\n\nSecurity boundary crossed: file confidentiality and integrity.\n\nAn authenticated attacker who knows or obtains a victim `file_id` can make Open WebUI authorize, through an attacker-owned shared chat:\n\n- reading the victim file via `GET /api/v1/files/{id}/content`, and\n- deleting the victim file via `DELETE /api/v1/files/{id}`.\n\n## Root Cause\n\nClient-controlled message file IDs are persisted without file authorization checks:\n\n```python\n# backend/open_webui/main.py\nawait Chats.insert_chat_files(\n    chat_id,\n    user_message.get('id'),\n    [\n        file_item.get('id')\n        for file_item in user_message_files\n        if file_item.get('type') == 'file'\n    ],\n    user.id,\n)\n```\n\n`insert_chat_files()` stores the provided IDs directly:\n\n```python\n# backend/open_webui/models/chats.py\nChat","public_affected_ranges":["<= 0.9.5"]}],"null_published_at":"2026-11-04T10:04:27.921Z","source_updated_at":"2026-07-20T21:04:20.000Z","source_disclosed_at":"2026-06-17T14:12:20.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T02:47:44.783Z"}],"next_cursor":null,"snapshot_revision":"42594"}