CVE-2026-29071 — Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

CVE-2026-29071

Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories PUBLISHED

Description (CNA)

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can read other users' private memories via `/api/v1/retrieval/query/collection`. Version 0.8.6 patches the issue.

Affected (CNA)

Vendor / product	Versions
open-webui / open-webui	affected < 0.8.6

CWE

CWE-639

References

https://github.com/open-webui/open-webui/security/advisories/GHSA-w9f8-gxf9-rhvw

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.