Incident: Three search paths that skipped the check

Module 6 · Incident file · About 30 minutes

What happened

Open WebUI is an open-source chat interface that many teams self-host, with retrieval over uploaded files and knowledge bases. On 12 April 2026 a contributor, Classic298, opened pull request #23627, "fix: enforce access checks on RAG vector search collection queries" (GitHub). It said that three code paths "all queried the vector store without verifying the user has read access to the underlying file or knowledge base." A maintainer's commit on 17 April changed the same function, and release v0.9.0 on 21 April listed "RAG collection query permissions: Vector search collection queries now enforce access checks before retrieval results are returned" (release notes).

The advisory, GHSA-h36f-rqpx-j5wx (CVE-2026-44560), was published on 5 May 2026 and rated medium, CVSS 6.5, with high impact on confidentiality (advisory). Versions up to 0.8.12 were affected. Its table lists five ways a chat request turns a file or knowledge base into a vector search: two had an access check, three had none. The cost it names is what an attacker could do, not damage seen: a user who learned a file or knowledge base ID could extract "full content of private files/knowledge bases", and "access revocation is ineffective for RAG content". The advisory reports no known exploitation.