fix: enforce ownership check on user-memory collection queries
Prevent authenticated users from querying other users' memory collections via the /query/doc and /query/collection endpoints. A new _validate_collection_access helper rejects requests for user-memory-{UUID} collections where the UUID does not match the requesting user. Admins bypass the check.
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
Note
Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/22109
**Author:** [@Classic298](https://github.com/Classic298)
**Created:** 3/1/2026
**Status:** ✅ Merged
**Merged:** 3/1/2026
**Merged by:** [@tjbck](https://github.com/tjbck)
**Base:** `dev` ← **Head:** `fix/memory-collection-access-check`
---
### 📝 Commits (5)
- [`f233bf2`](https://github.com/open-webui/open-webui/commit/f233bf23f4fc7c85cf06ab2af845e90a19e4b606) fix: enforce ownership check on user-memory collection queries
- [`4a2ed90`](https://github.com/open-webui/open-webui/commit/4a2ed90035a14a5833bc701519ba1d4e9fd18053) Merge branch 'dev' into fix/memory-collection-access-check
- [`cf2f797`](https://github.com/open-webui/open-webui/commit/cf2f797ff94c092d902c6845efc448d311980e51) Update retrieval.py
- [`df6e0e2`](https://github.com/open-webui/open-webui/commit/df6e0e26b5a0b19c063a4b033337fbd6ee7e20c0) Merge branch 'fix/memory-collection-access-check' of https://github.com/Classic298/open-webui into fix/memory-collection-access-check
- [`41b7bc8`](https://github.com/open-webui/open-webui/commit/41b7bc8ba54d7005d27ed5e3cf99e3d6a85d515b) Update retrieval.py
### 📊 Changes
**1 file changed** (+31 additions, -21 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/routers/retrieval.py` (+31 -21)
</details>
### 📄 Description
fix: enforce ownership check on user-memory collection queries
Prevent authenticated users from querying other users' memory collections via the /query/doc and /query/collection endpoints. A new _validate_collection_access helper rejects requests for user-memory-{UUID} collections where the UUID does not match the requesting user. Admins bypass the check.
### Contributor License Agreement
<!--
🚨 DO NOT DELETE THE TEXT BELOW 🚨
Keep the "Contributor License Agreement" confirmation text intact.
Deleting it will trigger the CLA-Bot to INVALIDATE your PR.
-->
By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
> [!NOTE]
> Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/22109
Author: @Classic298
Created: 3/1/2026
Status: ✅ Merged
Merged: 3/1/2026
Merged by: @tjbck
Base:
dev← Head:fix/memory-collection-access-check📝 Commits (5)
f233bf2fix: enforce ownership check on user-memory collection queries4a2ed90Merge branch 'dev' into fix/memory-collection-access-checkcf2f797Update retrieval.pydf6e0e2Merge branch 'fix/memory-collection-access-check' of https://github.com/Classic298/open-webui into fix/memory-collection-access-check41b7bc8Update retrieval.py📊 Changes
1 file changed (+31 additions, -21 deletions)
View changed files
📝
backend/open_webui/routers/retrieval.py(+31 -21)📄 Description
fix: enforce ownership check on user-memory collection queries
Prevent authenticated users from querying other users' memory collections via the /query/doc and /query/collection endpoints. A new _validate_collection_access helper rejects requests for user-memory-{UUID} collections where the UUID does not match the requesting user. Admins bypass the check.
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.