The vulnerability in Open WebUI allows an attacker to perform vector store queries without any authorization checks. By submitting requests with type "file" or "text" and specifying a collection name, an adversary can extract content from files and knowledge bases that they should not be able to read. This results in the disclosure of potentially sensitive internal data and constitutes an improper privilege escalation flaw (CWE-862).

All Open WebUI installations running a version earlier than 0.9.0 are affected. The vendor is open-webui. The vulnerability was resolved in version 0.9.0, which introduced proper authorization for vector query endpoints.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the web interface or API that processes vector search requests; an authenticated or unauthenticated user can trigger the vulnerable get_sources_from_items function to retrieve protected content. Since the issue is a lack of authorization checks, the exploitation requires network access to the Open WebUI instance but does not demand further system privileges.