fix: guard retrieval file processing access

[cursor]

Pull Request Checklist

Note to first-time contributors: Please open a discussion post in Discussions and describe your changes before submitting a pull request.

Before submitting, make sure you've checked the following:

• Target branch: Please verify that the pull request targets the dev branch.
• Description: Provide a concise description of the changes made in this pull request.
• Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
• Documentation: Have you updated relevant documentation Open WebUI Docs, or other documentation sources?
• Dependencies: Are there any new dependencies? Have you updated the dependency versions in the documentation?
• Testing: Have you written and run sufficient tests to validate the changes?
• Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
• Prefix: To clearly categorize this pull request, prefix the pull request title using one of the following:
  • BREAKING CHANGE: Significant changes that may affect compatibility
  • build: Changes that affect the build system or external dependencies
  • ci: Changes to our continuous integration processes or workflows
  • chore: Refactor, cleanup, or other non-functional code changes
  • docs: Documentation update or addition
  • feat: Introduces a new feature or enhancement to the codebase
  • fix: Bug fix or error correction
  • i18n: Internationalization or localization changes
  • perf: Performance improvement
  • refactor: Code restructuring for better maintainability, readability, or scalability
  • style: Changes that do not affect the meaning of the code (white space, formatting, missing semi-colons, etc.)
  • test: Adding missing tests or correcting existing tests
  • WIP: Work in progress, a temporary label for incomplete or ongoing work

Changelog Entry

Description

• Fixes an authorization bypass in retrieval file processing endpoints where an authenticated user could submit another user's file_id and cause the backend to extract and return private file content, or overwrite stored file content/hash/vector metadata through batch processing.

Added

• Added a small file-access helper with dependency-light regression coverage for owner, admin, and knowledge-base access semantics.

Changed

• Retrieval file processing now performs server-side file access validation before any read, write, or vector indexing operation.
• Batch file processing now re-fetches each file from the database instead of trusting client-supplied FileModel.data.

Deprecated

• None.

Removed

• None.

Fixed

• Prevented /api/v1/retrieval/process/file from processing arbitrary file IDs without owner/admin/authorized knowledge access.
• Prevented /api/v1/retrieval/process/files/batch from accepting client-supplied file content for arbitrary file IDs.
• Avoided crashes when authorized processing encounters files with null metadata or data.

Security

• Closes a high-impact IDOR path that could disclose private extracted file content and corrupt another user's stored file data/vector index.

Breaking Changes

• BREAKING CHANGE: None.

---

Additional Information

Validation performed:

• python3 -m py_compile backend/open_webui/routers/retrieval.py backend/open_webui/utils/file_access.py tests/test_file_access_helper.py
• Manual execution of tests/test_file_access_helper.py test functions: 4 passed (pytest is not installed in the base environment)
• git diff --check origin/main..HEAD

Screenshots or Videos

• Not applicable; backend security fix.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.