{
 "id": "AIR-2026-0307",
 "slug": "cve-2026-109285-open-webui-former-collaborators-retain-knowl",
 "title": "CVE-2026-109285: Open WebUI former collaborators retain knowledge base file access",
 "summary": "Open WebUI contains an access control flaw allowing former knowledge base collaborators to retain file access via stale cached references. Users can download or delete files from private knowledge bases after permission revocation.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-10-12",
 "incident_date_precision": "day",
 "first_reported": "2026-10-12",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109285",
   "publisher": "NVD",
   "title": "CVE-2026-109285: Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former…",
   "published_at": "2026-10-12"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-109285",
  "access-control",
  "open-webui"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}