What is the CVSS score of CVE-2026-29070?

CVE-2026-29070 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Open Webui are affected by CVE-2026-29070?

Organizations using Open WebUI should be aware of moderate risk from CVE-2026-29070, a missing authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-29070?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Open Webui CVE-2026-29070

EUVD-2026-16484 MEDIUM

Missing Authorization (CWE-862)

2026-03-27 security-advisories@github.com

GHSA-26gm-93rw-cchf

Authentication Bypass Open Webui Openwebui

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 27, 2026 - 00:22 euvd

EUVD-2026-16484

Analysis Generated

Mar 27, 2026 - 00:22 vuln.today

CVE Published

Mar 27, 2026 - 00:16 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base (or is admin), but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from arbitrary knowledge bases (as long as one knows the file id). Version 0.8.6 patches the issue.

AnalysisAI

Open WebUI versions prior to 0.8.6 allow authenticated users to delete arbitrary files from knowledge bases they have write access to, due to missing validation that files actually belong to the target knowledge base. An attacker with legitimate write permissions to any knowledge base can exploit this to delete files from other knowledge bases by crafting requests with known file identifiers, resulting in data loss and service disruption. No public exploit code or active exploitation has been reported at time of analysis.

Technical ContextAI

Open WebUI is a self-hosted artificial intelligence platform designed for offline operation. The vulnerability stems from an incomplete access control implementation in the file deletion functionality (CWE-862: Missing Authorization). The vulnerability affects the knowledge base file management system, where the deletion endpoint performs an insufficient authorization check by verifying only that the user has write access to the destination knowledge base, without validating the file's actual membership in that knowledge base. This allows an authenticated attacker to bypass the intended logical boundary between knowledge bases by submitting a DELETE request with a valid file identifier from a different knowledge base. The root cause is a failure to implement proper authorization logic that should verify both user permissions AND resource ownership before allowing deletion operations.

RemediationAI

Upgrade Open WebUI to version 0.8.6 or later immediately, as this version contains the patch that adds proper file ownership validation to the deletion authorization check. See the vendor security advisory at https://github.com/open-webui/open-webui/security/advisories/GHSA-26gm-93rw-cchf for detailed information and confirmation. Until patching is completed, restrict network access to the Open WebUI instance to trusted users and networks only, and consider implementing additional monitoring and audit logging on knowledge base file operations to detect unauthorized deletion attempts. For air-gapped deployments, the risk is reduced but patching should still be prioritized when update mechanisms become available.