Cross-user file read and deletion via forged metadata

Improper authorization in Open WebUI before 0.9.6 allows remote authenticated users to read or delete other users' private files. The model create, update, and import paths persist attacker-supplied meta.knowledge file IDs without validating access, while view_file and has_access_to_file later treat those IDs as authorization. Exploitation requires model-workspace permission or write access to a model and knowledge of a victim file ID; the result is extracted-text disclosure, content access, or deletion.