Attack Scenario

1. User A uploads a private document and uses it in RAG (the document is embedded into the vector store as collection file-<file_id>).
2. User A shares a chat or model referencing the file with User B, or User B otherwise obtains the file ID through a legitimate interaction.
3. User A later revokes User B's access to the file.
4. User B sends a chat completion request referencing the revoked file:

   POST /api/chat/completions
   {
     "model": "any-accessible-model",
     "messages": [{"role": "user", "content": "What does this document say about pricing?"}],
     "files": [{"type": "file", "id": "<revoked_file_id>"}]
   }
   

5. The non-full-context path (default) constructs collection name file-<id> and queries the vector store with no access check.
6. Matching chunks are injected into the LLM context, and the response contains the victim's private file content.

The same attack works via {"type": "text", "collection_name": "<knowledge_base_id>"} for knowledge bases.

Impact

• Access revocation is ineffective for RAG content — users who previously had access can continue extracting file and knowledge base content indefinitely
• Private document content can be systematically extracted through targeted queries
• Breaks the access control model for files and knowledge bases at the RAG layer

Preconditions

• Attacker must know the file ID or knowledge base ID (UUID) of the target resource
• The target file/knowledge base must have been processed into the vector store
• Attacker must have a valid user account