From 9f20687680272b72d58f492dc1914e45a0a40015 Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Thu, 28 May 2026 23:23:49 +0200 Subject: [PATCH] fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113) When called without attached model knowledge and given a caller-supplied knowledge_id, search_knowledge_files passed it straight to Knowledges.search_files_by_id, which does not enforce ownership on knowledge_id. An authenticated user who happened to know a target UUID could enumerate file metadata (filename, file id, KB id, KB name, updated_at) from any knowledge base, bypassing the AccessGrants permission model. Mirror the same admin/owner/AccessGrants check the attached-KB branch already uses, matching the sibling query_knowledge_files function. Co-authored-by: Claude Opus 4.7 (1M context) --- backend/open_webui/tools/builtin.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/backend/open_webui/tools/builtin.py b/backend/open_webui/tools/builtin.py index 74bdcdc9d1..83be15e6ef 100644 --- a/backend/open_webui/tools/builtin.py +++ b/backend/open_webui/tools/builtin.py @@ -1713,6 +1713,21 @@ async def search_knowledge_files( # No attached knowledge - search all accessible KBs if knowledge_id: + # search_files_by_id does not enforce knowledge_id ownership; mirror the attached-KB check above. + knowledge = await Knowledges.get_knowledge_by_id(knowledge_id) + if not knowledge or not ( + user_role == 'admin' + or knowledge.user_id == user_id + or await AccessGrants.has_access( + user_id=user_id, + resource_type='knowledge', + resource_id=knowledge.id, + permission='read', + user_group_ids=set(user_group_ids), + ) + ): + return json.dumps({'error': f'Access denied to knowledge base {knowledge_id}'}) + result = await Knowledges.search_files_by_id( knowledge_id=knowledge_id, user_id=user_id,