What is the CVSS score of CVE-2026-28788?

CVE-2026-28788 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Open Webui are affected by CVE-2026-28788?

Open WebUI versions before 0.8.6 contain a file-write vulnerability that allows authenticated users to bypass access controls and modify knowledge base content, enabling poisoning of AI-generated…. A patch is available.

How to fix or mitigate CVE-2026-28788?

Within 24 hours: Identify all Open WebUI deployments and document current versions in use. Within 7 days: Upgrade all instances to version 0.8.6 or later when released; if unavailable, implement network access restrictions to the batch processing endpoint and enforce role-based access control limiting knowledge base write permissions to administrators only. Within 30 days: Conduct audit of knowledge base modifications during the vulnerability window and validate integrity of RAG training datasets used by language models.

Open Webui CVE-2026-28788

EUVD-2026-16482 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-27 security-advisories@github.com

GHSA-jjp7-g2jw-wh3j

Authentication Bypass Open Webui Openwebui

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 27, 2026 - 00:22 euvd

EUVD-2026-16482

Analysis Generated

Mar 27, 2026 - 00:22 vuln.today

CVE Published

Mar 27, 2026 - 00:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/{id}/files and then overwrite those files, escalating from read to write. The overwritten content is served to the LLM via RAG, meaning the attacker controls what the model tells other users. Version 0.8.6 patches the issue.

AnalysisAI

Open WebUI versions prior to 0.8.6 permit authenticated users to overwrite arbitrary file contents through an insecure batch processing endpoint, escalating read-only knowledge base access to write permissions without ownership validation. Attackers with low-level privileges can manipulate RAG (Retrieval-Augmented Generation) content served to language models, poisoning AI responses delivered to other users. CVSS 7.1 (High) reflects network-accessible exploitation with low complexity requiring only standard user authentication; no public exploit identified at time of analysis.

Technical ContextAI

Open WebUI is a self-hosted LLM platform implementing Retrieval-Augmented Generation (RAG) for knowledge management. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the POST /api/v1/retrieval/process/files/batch endpoint accepts file UUIDs without verifying ownership or write permissions. Users with read access to shared knowledge bases can enumerate file identifiers via GET /api/v1/knowledge/{id}/files, then submit those UUIDs to the batch processing endpoint to inject malicious content. The compromised files are subsequently retrieved by the RAG pipeline and served to the LLM as authoritative context, enabling prompt injection attacks targeting other platform users. The affected software operates as cpe:2.3:a:open-webui:open-webui (inferred from GitHub advisory scope).

RemediationAI

Upgrade Open WebUI to version 0.8.6 or later, which includes authorization checks on the file batch processing endpoint (see GitHub Security Advisory https://github.com/open-webui/open-webui/security/advisories/GHSA-jjp7-g2jw-wh3j). Until patching is completed, implement compensating controls by restricting access to shared knowledge bases, limiting the number of authenticated users with read access to sensitive RAG content, and monitoring API calls to /api/v1/retrieval/process/files/batch for anomalous activity patterns such as users modifying files outside their owned collections. Consider deploying network segmentation to isolate Open WebUI instances from untrusted networks and enforce multi-factor authentication to reduce credential compromise risks.