CVE-2026-54019 Details

A vulnerability exists in Open WebUI versions prior to 0.9.6, allowing an authenticated low-privilege user to bypass collection-level access control list (ACL) checks when Milvus multitenancy mode is enabled. The issue arises because the ACL permits unknown non-knowledge base collection names as legacy or ephemeral collections. In Milvus multitenancy mode, these user-controlled collection names are treated as resource identifiers and interpolated into Milvus expressions without proper escaping. This flaw, stemming from an incomplete fix for a previous vulnerability, enables unauthorized access to private knowledge base content belonging to other users.

To address this vulnerability, Open WebUI should disallow arbitrary unknown collection names in user-controlled RAG query endpoints, escape or parameterize Milvus expression values before applying filters, reject collection names that contain quotes or control characters unless they conform to a known internal format, and add a regression test for the bypass payload in Milvus multitenancy mode.