{
 "id": "AIR-2026-0299",
 "slug": "cve-2026-109287-open-webui-knowledge-base-authorization-flaw",
 "title": "CVE-2026-109287: Open WebUI knowledge base authorization flaw exposes folder metadata",
 "summary": "Open WebUI contained an authorization flaw where knowledge base file listings failed to verify directory ownership. Users could query arbitrary directories to expose folder names, owner IDs, and parent hierarchy.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "data_leak"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-10-12",
 "incident_date_precision": "day",
 "first_reported": "2026-10-12",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109287",
   "publisher": "NVD",
   "title": "CVE-2026-109287: Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a…",
   "published_at": "2026-10-12"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-109287",
  "authorization",
  "information-disclosure"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}