{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/authorization_bypass/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open WebUI"],"_cs_severities":["high"],"_cs_tags":["idor","authorization_bypass","data_manipulation"],"_cs_type":"advisory","_cs_vendors":["Open Web UI"],"content_html":"\u003cp\u003eOpen WebUI, a web interface for language models, is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in its Retrieval API. This flaw, identified in commit \u003ccode\u003e4d058a125\u003c/code\u003e (v0.8.11) on March 26, 2026, allows authenticated users to bypass knowledge base access controls. Specifically, the \u003ccode\u003e_validate_collection_access\u003c/code\u003e function fails to properly validate access to knowledge base collections, which use UUIDs as collection names. As a result, an attacker who knows the UUID of a private knowledge base can read its contents, inject malicious content, or even overwrite the entire knowledge base through the retrieval query endpoints. This vulnerability exists because the validation function only checks for \u0026ldquo;user-memory-\u003cem\u003e\u0026rdquo; and \u0026ldquo;file-\u003c/em\u003e\u0026rdquo; prefixes, leaving knowledge base UUIDs unchecked. This vulnerability is reachable in default configurations, affecting any non-admin account.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains an authenticated account on the Open WebUI instance.\u003c/li\u003e\n\u003cli\u003eVictim user creates a private knowledge base containing sensitive information.\u003c/li\u003e\n\u003cli\u003eAttacker discovers the UUID of the victim\u0026rsquo;s knowledge base through methods such as shared workspaces, model metadata leakage via the \u003ccode\u003e/api/models/list\u003c/code\u003e endpoint, URL leakage, or RAG citation metadata in shared chats.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious POST request to \u003ccode\u003e/api/v1/retrieval/query/doc\u003c/code\u003e or \u003ccode\u003e/api/v1/retrieval/query/collection\u003c/code\u003e with the victim\u0026rsquo;s knowledge base UUID as the \u003ccode\u003ecollection_name\u003c/code\u003e, bypassing authorization checks and reading the contents of the knowledge base.\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker crafts a POST request to \u003ccode\u003e/api/v1/retrieval/process/text\u003c/code\u003e with the victim\u0026rsquo;s knowledge base UUID as the \u003ccode\u003ecollection_name\u003c/code\u003e to inject attacker-controlled content into the knowledge base.\u003c/li\u003e\n\u003cli\u003eOr, the attacker crafts a POST request to \u003ccode\u003e/api/v1/retrieval/process/web\u003c/code\u003e or \u003ccode\u003e/api/v1/retrieval/process/youtube\u003c/code\u003e with the victim\u0026rsquo;s knowledge base UUID as the \u003ccode\u003ecollection_name\u003c/code\u003e to overwrite the victim\u0026rsquo;s entire knowledge base.\u003c/li\u003e\n\u003cli\u003eThe injected or replaced content is then used in downstream RAG processes, potentially leading to the exposure of sensitive information or prompt injection attacks.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully compromises the confidentiality, integrity, and availability of the victim\u0026rsquo;s knowledge base.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability allows unauthorized access to private knowledge bases, potentially exposing sensitive information. Attackers can inject malicious content, leading to integrity breaches and potential prompt injection attacks. The ability to overwrite knowledge bases leads to availability issues and data destruction. A successful attack can compromise the confidentiality, integrity, and availability of user data, potentially affecting all users of the Open WebUI instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the following Sigma rule to detect unauthorized access to knowledge bases by monitoring API requests containing UUID-formatted \u003ccode\u003ecollection_name\u003c/code\u003e parameters: \u003ccode\u003eDetect Open WebUI Unauthorized Knowledge Base Access\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Open WebUI Knowledge Base Manipulation via Retrieval API\u003c/code\u003e to identify malicious POST requests to \u003ccode\u003e/api/v1/retrieval/process/*\u003c/code\u003e endpoints with knowledge base UUIDs as \u003ccode\u003ecollection_name\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eApply the remediation steps suggested in the original advisory by checking permission on the KB collection in the \u003ccode\u003e_validate_collection_access\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for unusual activity related to the vulnerable endpoints (\u003ccode\u003e/api/v1/retrieval/query/doc\u003c/code\u003e, \u003ccode\u003e/api/v1/retrieval/query/collection\u003c/code\u003e, \u003ccode\u003e/api/v1/retrieval/process/text\u003c/code\u003e, \u003ccode\u003e/api/v1/retrieval/process/web\u003c/code\u003e, \u003ccode\u003e/api/v1/retrieval/process/youtube\u003c/code\u003e, \u003ccode\u003e/api/v1/retrieval/process/file\u003c/code\u003e, \u003ccode\u003e/api/v1/retrieval/process/files/batch\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-14T20:32:37Z","date_published":"2026-05-14T20:32:37Z","id":"https://feed.craftedsignal.io/briefs/2026-05-open-webui-idor/","summary":"Open WebUI is vulnerable to an IDOR vulnerability in its Retrieval API that bypasses knowledge base access controls, allowing any authenticated user who knows a private knowledge base UUID to read, inject content into, or overwrite another user's knowledge base.","title":"Open WebUI IDOR Vulnerability in Retrieval API Allows Unauthorized Access and Modification of Knowledge Bases","url":"https://feed.craftedsignal.io/briefs/2026-05-open-webui-idor/"}],"language":"en","title":"CraftedSignal Threat Feed — Authorization_bypass","version":"https://jsonfeed.org/version/1.1"}