[GH-ISSUE #15118] issue: Uploaded files visible across accounts when switching users #137202

New Issue

GiteaMirror · 2026-05-25T06:33:24-05:00

GiteaMirror commented

2026-05-25 06:33:24 -05:00

Originally created by @TatianiKat on GitHub (Jun 18, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/15118

Bug Report

Important Notes

Before submitting a bug report: Please check the Issues or Discussions sections for similar issues.
Respectful collaboration: Open WebUI is a volunteer-driven project with a single maintainer and contributors who also have full-time jobs. Please be constructive and respectful in your comments.
Contributing: If you encounter an issue, consider submitting a pull request or forking the project. We prioritize preventing contributor burnout to maintain Open WebUI's quality.
Bug Reproducibility: If a bug cannot be reproduced using a :main or :dev Docker setup or with pip install on Python 3.11, community assistance may be required. In such cases, we may not be able to provide immediate support.

Check Existing Issues

I have searched the existing issues and discussions.
I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

0.6.15

Ollama Version (if applicable)

llama 3.3.7

Operating System

Windows

Browser (if applicable)

Chrome

Confirmation

I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env settings, etc.).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
- Start with the initial platform/version/OS and dependencies used,
- Specify exact install/launch/configure commands,
- List URLs visited, user input (incl. example values/emails/passwords if needed),
- Describe all options and toggles enabled or changed,
- Include any files or environmental changes,
- Identify the expected and actual result at each stage,
- Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

When switching between user accounts, any files that were uploaded but not yet sent should not be visible to the new user. Each user session should isolate unsent uploads for privacy and security.

Actual Behavior

When I switch accounts (for example, log out from one user and log in as another), any files that were uploaded but not yet sent are still visible in the upload area for the new user. This creates a privacy issue, as files intended for one user are accessible to another.

Steps to Reproduce

Start with a clean Windows install and Open WebUI 0.6.15 via Docker.
Open Chrome and log in to Open WebUI as User A.
Upload a file but do not send/submit it.
Log out or switch to User B.
Observe that the file uploaded by User A is still visible and accessible to User B in the upload area.

Logs & Screenshots

Please see browser console and Docker logs for more details.

Additional Information

This bug may be due to temporary upload storage (frontend or backend) not being isolated or cleared on account switch. Uploaded files should be tied to the current session/user. Please advise if more information is needed.

Originally created by @TatianiKat on GitHub (Jun 18, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/15118 # Bug Report ## Important Notes - **Before submitting a bug report**: Please check the [Issues](https://github.com/open-webui/open-webui/issues) or [Discussions](https://github.com/open-webui/open-webui/discussions) sections for similar issues. - **Respectful collaboration**: Open WebUI is a volunteer-driven project with a single maintainer and contributors who also have full-time jobs. Please be constructive and respectful in your comments. - **Contributing**: If you encounter an issue, consider submitting a pull request or forking the project. We prioritize preventing contributor burnout to maintain Open WebUI's quality. - **Bug Reproducibility**: If a bug cannot be reproduced using a `:main` or `:dev` Docker setup or with `pip install` on Python 3.11, community assistance may be required. In such cases, we may not be able to provide immediate support. ## Check Existing Issues - [x] I have searched the existing issues and discussions. - [x] I am using the latest version of Open WebUI. ## Installation Method Docker ## Open WebUI Version 0.6.15 ## Ollama Version (if applicable) llama 3.3.7 ## Operating System Windows ## Browser (if applicable) Chrome ## Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [ ] I have included the browser console logs. - [ ] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env settings, etc.). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ## Expected Behavior When switching between user accounts, any files that were uploaded but not yet sent should not be visible to the new user. Each user session should isolate unsent uploads for privacy and security. ## Actual Behavior When I switch accounts (for example, log out from one user and log in as another), any files that were uploaded but not yet sent are still visible in the upload area for the new user. This creates a privacy issue, as files intended for one user are accessible to another. ## Steps to Reproduce 1. Start with a clean Windows install and Open WebUI 0.6.15 via Docker. 2. Open Chrome and log in to Open WebUI as User A. 3. Upload a file but do not send/submit it. 4. Log out or switch to User B. 5. Observe that the file uploaded by User A is still visible and accessible to User B in the upload area. ## Logs & Screenshots - Please see browser console and Docker logs for more details. ## Additional Information This bug may be due to temporary upload storage (frontend or backend) not being isolated or cleared on account switch. Uploaded files should be tied to the current session/user. Please advise if more information is needed.

GiteaMirror closed this issue

2026-05-25 06:33:25 -05:00

GiteaMirror commented

2026-05-25 06:33:29 -05:00

@tjbck commented on GitHub (Jun 18, 2025):

Good catch, should be addressed with 1547235d473ae2ebfd5136ed175742a95514a048!

@tjbck commented on GitHub (Jun 18, 2025): Good catch, should be addressed with 1547235d473ae2ebfd5136ed175742a95514a048!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#137202