What is the CVSS score of CVE-2026-59212?

CVE-2026-59212 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-59212?

Yes, a public proof-of-concept exploit is available for CVE-2026-59212. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-59212?

Yes, a patch is available for CVE-2026-59212. Update the affected software to the latest version immediately.

Open WebUI CVE-2026-59212

EUVD-2026-42634 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-09 security-advisories@github.com

GHSA-2xwm-4h2q-ggfx

Authentication Bypass Open Webui Openwebui

5.4

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-accessible web API requiring a low-privilege authenticated account; impact confined to knowledge file integrity and availability, with no confidentiality gain since attacker already holds read access.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jul 09, 2026 - 18:01 EUVD

Analysis Generated

Jul 09, 2026 - 17:40 vuln.today

DescriptionCVE.org

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_knowledge_file_access only checked read access while file write and delete routes later trusted object-derived access through writable model meta.knowledge entries, allowing a user with read-only knowledge file access to upgrade to file write or delete operations. This issue is fixed in version 0.10.0.

AnalysisAI

Incorrect authorization in Open WebUI versions 0.9.6 through 0.9.x allows authenticated users with read-only knowledge file access to escalate their privileges to file write or delete operations. The root cause is that _verify_knowledge_file_access validated only read permissions, while write and delete routes independently trusted access derived from writable model meta.knowledge entries - creating a logical gap where the authorization check and the actual enforcement were misaligned. No public exploit or CISA KEV listing is identified at time of analysis; this is a medium-severity, authenticated-only issue fixed in v0.10.0.

Technical ContextAI

Open WebUI (CVE-2026-59212) is a self-hosted AI platform that manages knowledge bases, with access control implemented via _verify_knowledge_file_access. The flaw maps to CWE-863 (Incorrect Authorization): the authorization function performed a read-access check, but the file write and delete HTTP routes derived their access decisions from a different source - writable model meta.knowledge entries - without re-validating the operation type against the user's actual permission level. This is a classic TOCTOU-style authorization gap where the check and the action use inconsistent access models. The affected code path involves knowledge file CRUD routes in the API layer.

RemediationAI

Upgrade to Open WebUI v0.10.0 or later, which resolves the authorization gap via the fix committed at https://github.com/open-webui/open-webui/commit/17df0264929514599dbcb21c6578bcdfa204b04d and tracked in pull request https://github.com/open-webui/open-webui/pull/26032. The full security advisory is available at https://github.com/open-webui/open-webui/security/advisories/GHSA-2xwm-4h2q-ggfx. If immediate upgrade is not possible, a compensating control is to restrict knowledge file sharing so that no user is granted read-only access to files they must not modify - effectively eliminating the exploitable condition by not assigning partial permissions. This workaround limits collaboration functionality and is not a substitute for patching.