Open Webui CVE-2026-28788

Requires authenticated user account on Open WebUI versions prior to 0.8.6. Attacker must have read access to a shared knowledge base to enumerate file UUIDs via GET endpoint, then exploits missing ownership validation in POST /api/v1/retrieval/process/files/batch to overwrite file content. No victim interaction needed.

Real-world risk is moderate-to-high despite the 7.1 CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity, but requires authenticated access and targets integrity rather than confidentiality (C:N/I:H/A:L). The attack is highly automatable once valid credentials are obtained, making it suitable for insider threats or compromised accounts in multi-tenant environments. The integrity impact is severe because attackers control AI-generated outputs, enabling misinformation campaigns, social engineering, or business logic manipulation through poisoned RAG responses. No EPSS score or KEV listing is provided in the input data, and no public exploit identified at time of analysis, suggesting limited observed exploitation. However, the trivial technical complexity (simple API calls with known UUIDs) and the security-critical nature of LLM trust boundaries elevate this beyond typical authorization flaws. Organizations using Open WebUI for shared knowledge bases with multiple authenticated users should prioritize remediation.

An authenticated attacker with read-only access to a corporate knowledge base queries GET /api/v1/knowledge/{id}/files to enumerate file UUIDs associated with technical documentation or policy content. The attacker then sends POST requests to /api/v1/retrieval/process/files/batch with those UUIDs and malicious payloads replacing legitimate content. When other users query the LLM for information, the RAG system retrieves the poisoned files, causing the AI to deliver fabricated technical instructions, altered compliance guidance, or social engineering prompts designed to extract credentials or authorize fraudulent transactions.