[GHSA] GHSA-pcvc-8vrv-8q6w (medium) — Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

GHSA-pcvc-8vrv-8q6w Severity: medium CVE: CVE-2026-87017

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

## Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and