The flaw in Open WebUI’s _validate_collection_access function allows any authenticated user to read the system’s knowledge‑bases meta‑collection. This collection contains the identifiers, names, and descriptions of every knowledge base on the instance, effectively revealing a global inventory of all users’ data. The weakness is a classic access‑control bypass (CWE‑863) and does not grant code execution or privilege escalation, but it exposes sensitive information that could aid further attacks.

The vulnerability affects the open-webui:open-webui product, specifically all releases prior to 0.9.0 of the self‑hosted AI platform. Those deploying older versions are susceptible to enumeration of all knowledge bases across all users.

With a CVSS score of 4.3 the flaw is considered medium severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not currently reported. Because the attack requires an authenticated session, an attacker must first gain valid credentials; once authenticated, the attacker can simply query retrieval endpoints to enumerate all knowledge bases, potentially aiding social‑engineering or phishing campaigns.