Open WebUI Multitenancy and File Access Vulnerabilities

Our Open WebUI deployment contains critical security flaws that allow authenticated users to bypass access controls and view private company data belonging to others. These vulnerabilities effectively break the isolation between users, enabling unauthorized access to both sensitive knowledge-base documents and private files.

• business impact:The platform currently fails to enforce data privacy, creating a high probability of unauthorized internal data exposure and potential regulatory non-compliance.
• decision:Immediately restrict access to the Open WebUI platform or disable the affected Milvus multitenancy and file-processing features until a verified security patch is applied.
• risk level:High

drafted: gemini

We face an immediate escalation in data exfiltration risk within our LLM infrastructure due to critical ACL bypasses in Open WebUI. These vulnerabilities allow authenticated users to harvest private knowledge-base data and sensitive files across user boundaries, effectively nullifying our existing multi-tenancy controls.

• posture change:Our RAG and file-handling architecture is currently compromised; the assumption of data isolation between users is invalid for deployments using Milvus or file-based uploads.
• programme action:Immediately disable Milvus multi-tenancy and restrict file-upload features until a verified patch is deployed; audit all existing RAG collections for unauthorized cross-user access patterns.
• board message:We have identified a critical security flaw in our AI interface that exposes internal data to unauthorized users. We are taking immediate containment steps to prevent data leakage while we remediate the underlying software vulnerabilities.

drafted: gemini

Your Open WebUI instance is vulnerable to critical data exfiltration if you have Milvus multitenancy enabled or are running v0.9.5. Authenticated attackers can bypass ACLs to scrape private knowledge-base chunks or use the image_url field to force the LLM to read and disclose arbitrary files from the server's filesystem.

• exposure:High: Any authenticated user can extract private data from other users' knowledge bases or unauthorized files via the LLM prompt.
• action priority:Critical: Immediately disable Milvus multitenancy or restrict Open WebUI access to trusted users only until a patch is applied.
• detection:Monitor logs for POST /api/chat/completions requests containing suspicious file IDs in the image_url.url field or anomalous Milvus collection access patterns.

drafted: gemini

Open WebUI's RAG ACL bypass and unauthorized file disclosure represent a critical security regression for enterprise deployments utilizing Milvus multitenancy. These vulnerabilities undermine the core value proposition of private, secure LLM interactions, creating significant liability for organizations relying on the platform for sensitive data processing.

• market impact:Immediate reputational risk and potential churn for enterprise users; necessitates emergency patching cycles that disrupt deployment roadmaps.
• affected sectors:Enterprise AI, SaaS infrastructure, Cybersecurity, and Managed LLM Services.
• thesis:The failure to properly sanitize user-controlled inputs in multi-tenant environments highlights a lack of enterprise-grade security maturity in Open WebUI, favoring competitors with more robust, audited access control frameworks.

drafted: gemini

These vulnerabilities expose a dangerous cognitive bias in software design: the assumption that system-level security controls (like Milvus multitenancy) are inherently robust without rigorous input sanitization. For users, this confirms that 'private' knowledge bases are often a psychological comfort rather than a technical guarantee, as simple injection flaws can bypass complex access control logic.

• human angle:The failure stems from a classic trust-boundary error where the system implicitly trusts user-provided parameters, effectively turning the LLM into an unwitting accomplice that exfiltrates private data.
• belief effect:This challenges the perception that enterprise-grade features like multitenancy provide absolute isolation, revealing that underlying implementation flaws can render these architectural safeguards entirely moot.
• evidence strength:High; the technical root cause is explicitly identified as a failure to escape user-controlled inputs and a lack of ownership validation, providing a direct causal link to the unauthorized data access.

drafted: gemini

The Open WebUI vulnerabilities constitute a critical failure in logical access controls, enabling unauthorized cross-tenant data exfiltration and potential exposure of sensitive PII or proprietary information. For compliance officers, this represents a direct breach of data isolation requirements, necessitating an immediate audit of RAG deployments and vector database configurations to prevent unauthorized data processing.

• obligation:Mandatory incident response and data breach assessment under GDPR Article 32 (Security of Processing) and Article 33 (Notification of personal data breaches), alongside potential SEC disclosure obligations if the unauthorized access results in a material impact on the organization's information security posture.
• frameworks:GDPR, NIS2 (Security of Supply Chain), ISO/IEC 27001 (Access Control), and EU AI Act (Governance and Data Quality requirements).
• disclosure window:Immediate remediation required; GDPR mandates notification to supervisory authorities without undue delay and, where feasible, not later than 72 hours after becoming aware of a breach involving personal data.

drafted: gemini

The Open WebUI vulnerabilities demonstrate a critical failure in enforcing multi-tenant isolation, effectively weaponizing RAG pipelines to exfiltrate private data. By bypassing ACLs and exploiting insecure file resolution, the system allows authenticated users to treat the LLM as an oracle for unauthorized data extraction, highlighting a systemic disregard for secure-by-design principles in open-source AI interfaces.

• safety implication:The lack of robust ownership validation in RAG and file-handling middleware transforms the LLM into an exfiltration vector, violating the fundamental safety requirement of data isolation in multi-user environments.
• misuse risk:Authenticated users can perform unauthorized cross-user data harvesting, turning the LLM's reasoning capabilities against the system's own private knowledge base to bypass access controls.
• governance gap:The recurrence of these vulnerabilities—specifically the regression of previous fixes—exposes a failure in secure coding practices and verification processes, indicating that current governance frameworks for open-source AI tools are insufficient to prevent the deployment of insecure multi-tenant architectures.

drafted: gemini

The Open WebUI vulnerabilities represent a failure of digital boundaries, where the architecture of shared knowledge systems prioritizes technical convenience over the sanctity of individual data sovereignty. By collapsing the distinction between private and public information, these flaws transform collaborative tools into instruments of surveillance, eroding the trust essential for human agency in digital spaces.

• societal impact:This vulnerability undermines the social contract of digital platforms, where users expect their private knowledge bases to remain shielded from the collective; it effectively turns the user's own interface into a tool for unauthorized data extraction.
• who is affected:Institutional and individual users operating within multitenant environments who rely on the platform to maintain strict silos between proprietary or personal data and shared LLM processing.
• freedom effect:It constrains human freedom by introducing a 'chilling effect' on intellectual exploration; when users cannot guarantee the privacy of their knowledge repositories, they are forced to self-censor, limiting the creative and analytical potential of the digital commons.

drafted: gemini

Open WebUI v0.9.5 contains two critical authorization flaws: an RAG ACL bypass in Milvus multitenancy mode via unescaped collection name injection, and an IDOR vulnerability in the file handling pipeline. These flaws allow authenticated users to exfiltrate private knowledge-base chunks and arbitrary files by manipulating API payloads, effectively bypassing multi-user isolation.

• mechanism:The RAG bypass stems from unsanitized user input in Milvus expression interpolation, while the file disclosure occurs because the convert_url_images_to_base64 function fails to validate ownership of file IDs passed in image_url.url before processing.
• exploit likelihood:High. Both vulnerabilities are trivial to exploit; the file disclosure requires only a known or brute-forced file ID, and the RAG bypass requires only standard authenticated access to the chat API.
• adoption steps:Immediately patch to the latest version. If patching is delayed, disable Milvus multitenancy mode, restrict access to the file upload/chat endpoints, and implement egress filtering to monitor for unusual LLM output patterns indicative of unauthorized file content retrieval.

drafted: gemini