[GH-ISSUE #18212] issue: file access control, no content, admin file permission, file 404 #18530

Closed
opened 2026-04-20 00:45:44 -05:00 by GiteaMirror · 1 comment
Owner

Originally created by @Hekas1 on GitHub (Oct 10, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18212

Check Existing Issues

  • I have searched for any existing and/or related issues.
  • I have searched for any existing and/or related discussions.
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.6.33

Ollama Version (if applicable)

No response

Operating System

Windows 10

Browser (if applicable)

No response

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided every relevant configuration, setting, and environment variable used in my setup.
  • I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
  • I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
  • Start with the initial platform/version/OS and dependencies used,
  • Specify exact install/launch/configure commands,
  • List URLs visited, user input (incl. example values/emails/passwords if needed),
  • Describe all options and toggles enabled or changed,
  • Include any files or environmental changes,
  • Identify the expected and actual result at each stage,
  • Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

Using the interface's dialog channels, the administrator posts a file. Files sent by a user with administrator access level cannot be opened by a user with user access level. The user receives a "No content" message.

Actual Behavior

If a user with user rights sends a file to a dialogue channel between interface users, the file is available for viewing.

Steps to Reproduce

  1. The administrator creates a channel
  2. Full access to the channel is granted
  3. The administrator sends a file to the channel chat
  4. Members attempt to interact with the file if necessary
  5. When attempting to open the file, I receive a "No content" error

Logs & Screenshots

Logs when attempting to access a file uploaded by an admin by a user with user level
2025-10-10 14:13:20.066 | 2025-10-10 10:13:20.066 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.19.0.1:0 - "GET /api/v1/files/89b7df77-72d2-4f28-8eb7-5cbe3a27843d HTTP/1.1" 404
2025-10-10 14:13:21.674 | 2025-10-10 10:13:21.674 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.19.0.1:0 - "GET /api/v1/files/89b7df77-72d2-4f28-8eb7-5cbe3a27843d/content HTTP/1.1" 404

Image

Additional Information

No response

Originally created by @Hekas1 on GitHub (Oct 10, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/18212 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.6.33 ### Ollama Version (if applicable) _No response_ ### Operating System Windows 10 ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior Using the interface's dialog channels, the administrator posts a file. Files sent by a user with administrator access level cannot be opened by a user with user access level. The user receives a "No content" message. ### Actual Behavior If a user with user rights sends a file to a dialogue channel between interface users, the file is available for viewing. ### Steps to Reproduce 1) The administrator creates a channel 2) Full access to the channel is granted 3) The administrator sends a file to the channel chat 4) Members attempt to interact with the file if necessary 5) When attempting to open the file, I receive a "No content" error ### Logs & Screenshots Logs when attempting to access a file uploaded by an admin by a user with user level 2025-10-10 14:13:20.066 | 2025-10-10 10:13:20.066 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.19.0.1:0 - "GET /api/v1/files/89b7df77-72d2-4f28-8eb7-5cbe3a27843d HTTP/1.1" 404 2025-10-10 14:13:21.674 | 2025-10-10 10:13:21.674 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.19.0.1:0 - "GET /api/v1/files/89b7df77-72d2-4f28-8eb7-5cbe3a27843d/content HTTP/1.1" 404 <img width="1046" height="266" alt="Image" src="https://github.com/user-attachments/assets/a622255c-4fd4-400a-849f-d86166731ac8" /> ### Additional Information _No response_
GiteaMirror added the bug label 2026-04-20 00:45:44 -05:00
Author
Owner

@tjbck commented on GitHub (Oct 10, 2025):

Intended behaviour currently. #8050

<!-- gh-comment-id:3391423932 --> @tjbck commented on GitHub (Oct 10, 2025): Intended behaviour currently. #8050
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#18530