CyberRota Analysis
AI-GeneratedThe built-in knowledge search tool in Open WebUI versions 0.7.0 to 0.11.1 is vulnerable, allowing authenticated users to enumerate identifiers, names, and descriptions of inaccessible knowledge bases due to a metadata filter bypass in eleven vector backends. This could lead to unauthorized information disclosure, potentially exposing sensitive data structures. Organizations using affected versions should prioritize upgrading to version 0.11.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filter. An authenticated user on an affected backend could enumerate the identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection, although the associated document text remained in separate collections. This issue is fixed in version 0.11.1.