Open WebUI contains a missing permission check in all files API endpoints. An authenticated user can list, read, and delete every file uploaded by any user, effectively bypassing ownership controls. This allows the attacker to exfiltrate confidential data, modify or erase evidence, and disrupt services.

Open WebUI, a self-hosted AI platform that can be run offline, is affected. All releases prior to 0.3.16 are vulnerable. The vulnerability impacts any deployment where the files API is exposed, including internal private cloud and on-premises setups.

The CVSS score of 8.1 indicates high severity. An authenticated user can list, access, and delete any uploaded file, effectively bypassing ownership controls. The CVE description does not explicitly state the attack vector, but based on the description it is inferred that an attacker would need valid credentials and could exploit the flaw remotely over the network once authenticated. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet; the lack of a permission check makes the flaw trivially exploitable once credentials are obtained.