Open WebUI is a self‑hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6 it has a Broken Object Level Authorization (BOLA) vulnerability in its builtin search_knowledge_files tool. When native function calling is enabled and the selected model has no attached knowledge bases, an authenticated user can call search_knowledge_files with an arbitrary knowledge_id. The function then returns file metadata from that knowledge base without checking whether the user has read access, allowing unauthorized enumeration of private or restricted knowledge base files. This vulnerability is fixed in version 0.9.6. The flaw is classified as CWE-639.

Open WebUI versions earlier than 0.9.6, specifically 0.9.5 and earlier.

With a CVSS score of 4.3, the vulnerability is rated as low severity. The EPSS is not available and the vulnerability is not listed in CISA KEV. Exploitation requires a valid authenticated session; once inside, attackers can enumerate files in knowledge bases that lack proper access controls. No direct code execution or denial of service is exposed, but the disclosure of file metadata could aid broader reconnaissance or lead to identifying sensitive content within the knowledge base.