$ the-wire · showcase
Open WebUI patches auth bypass and knowledge-base BOLA
By RepoJournal · Filed · About Open WebUI
Open WebUI shipped fixes for two access-control vulnerabilities, including a request smuggling-style auth bypass and a broken-object-level-authorization flaw that leaked file metadata.
Open WebUI closed an API key endpoint bypass in the auth layer [1]. The fix switches the restriction check from request.url.path to request.scope["path"] because Starlette reconstructs url.path from the unvalidated HTTP Host header; an attacker could craft a Host header so the routed path and the checked path diverged. This is a breaking change only in the sense that it closes the bypass, so deployments on any Starlette version prior to 1.0 should upgrade immediately.
A separate BOLA fix [2] adds a knowledge_id access check in search_knowledge_files. Previously, a caller-supplied knowledge_id was passed straight to Knowledges.search_files_by_id without ownership enforcement, so any authenticated user who knew a target UUID could enumerate file metadata (filename, file id, KB id, KB name, updated_at) from any knowledge base. After this change, the AccessGrants permission model gates that path.
A prompt-fetching bug [3] caused a NameError in _get_access_grants and _to_prompt_model, which referenced an undefined local 'session' instead of the 'db' parameter; the error was swallowed by a broad except clause, so every prompt fetch silently failed. The fix resolves the variable, restoring normal prompt loading.
Localization continues: Chinese and Finnish translations were improved [4][5].
Action items
- → Upgrade Open WebUI to a build containing commit 66126f38617b9ed00e63f8195565fd174dcc53f5 before your next deploy, especially if you expose the API key endpoint open-webui/open-webui [immediate]
- → Review your knowledge base usage after applying the BOLA fix; any code that relied on search_knowledge_files without an attached model knowledge may need to pass an authorized knowledge_id open-webui/open-webui [plan]
- → Monitor prompt fetching after updating, since the NameError fix restores behavior that was previously silently failing open-webui/open-webui [monitor]
References
- [1] fix(auth): use request.scope["path"] to prevent CVE-2026-48710 (BadHost) (#25123) ↗ open-webui/open-webui
- [2] fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113) ↗ open-webui/open-webui
- [3] fix(prompts): resolve undefined session variable in _get_access_grants and _to_prompt_model (#25129) ↗ open-webui/open-webui
- [4] I18n/improve chinese translation ↗ open-webui/open-webui
- [5] i18n: Update fi-FI translation ↗ open-webui/open-webui
