Multiple endpoints in Open WebUI accept a file identifier supplied by the caller and attach the referenced file to a resource or returning its content. The reference is not validated against the caller’s ownership or granted permissions, allowing any authenticated user to retrieve or overwrite another user's private file if the file’s UUID is known. This results in confidentiality compromise and potential integrity modification, as the attacker can replace files in the knowledge‑base.

The flaw exists in the open-webui product before version 0.9.5. Specific affected modules are backend/open_webui/routers/folders.py (POST /​api/v1/folders/{id}/update), backend/open_webui/routers/knowledge.py (add_file_to_knowledge_by_id) and add_files_to_knowledge_by_id_batch. The vulnerability is fixed in release 0.9.5.

The CVSS score of 8.1 classifies the flaw as high severity. The EPSS score is not provided, but the straightforward nature of the flaw suggests a realistic exploitation probability once an authenticated account with knowledge of a UUID is available. The flaw is not listed in the CISA KEV catalog. Attackers require only valid credentials and the file UUID; no public exploit is currently documented, but the vulnerability remains a significant risk for any self-hosted deployment.