EUVD-2026-52926
GHSA-3cg5-48j3-v4gv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable API endpoint, no special attack conditions beyond authenticated write-collaborator access, no confidentiality impact, and permanent data destruction yields high I and A.
Primary rating from Vendor (https://github.com/open-webui/open-webui).
CVSS VectorVendor: https://github.com/open-webui/open-webui
Lifecycle Timeline
3DescriptionCVE.org
Summary
A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of ownership. Root folders were restricted to the owner or an admin, subfolders were not.
Preconditions
The Folders Sharing permission (user.permissions.sharing.folders) must be enabled; it is off by default. The victim must have shared a folder with the attacker at write access. features.folders and the chat.delete permission are enabled by default and are both required. Deployments that leave folder sharing disabled are not affected, and neither are single-user instances.
Impact
Permanent, irreversible destruction of another user's chat history within and beneath a shared folder. With delete_contents=false the same request instead force-moved the owner's chats out of the folder, an unauthorized relocation rather than a deletion. The write grant on the shared root folder is inherited by every descendant, so the attacker could destroy subfolders that were never explicitly shared with them. Nothing outside the shared folder's subtree is reachable, and no data is disclosed that write access did not already expose.
Fix
Fixed in 0.11.0 by https://github.com/open-webui/open-webui/pull/27003. Folder deletion is now restricted to the folder owner or an admin for root folders and subfolders alike, replacing the previous root/subfolder split with a single check. Upgrading fully resolves the issue; no configuration change is required. Owners and admins are unaffected, and a write-collaborator can still create, rename and add to shared folders and delete subfolders they own.
Root cause
Affected component: backend/open_webui/routers/folders.py, the DELETE /api/v1/folders/{id} handler. Affected setup: any release from 0.10.0 onward that has folder sharing enabled.
The cascade that follows the authorization check is bound to the folder owner's id, not the caller's, so whoever passes the check deletes the owner's data. The check itself branched on whether the folder had a parent: root folders demanded ownership or admin, while subfolders accepted any write grant. Because write grants propagate down the folder tree, that branch handed every collaborator deletion rights over the owner's subtree, which is broader than what the sharing model grants write access.
Credits
@legobattman, who reported the issue and its remediation.
AnalysisAI
Unauthorized permanent deletion of chat history in Open WebUI 0.10.x allows any authenticated write-collaborator on a shared folder to destroy the folder owner's chats, messages, and entire subfolder subtree via the DELETE /api/v1/folders/{id} endpoint. The flaw stems from a split authorization check that enforced ownership for root folders but accepted write-grant access for subfolders, while the cascade deletion itself ran under the owner's identity - meaning the collaborator's lower-privilege check granted them the owner's destructive reach. No public exploit has been identified at time of analysis, and exploitation requires a non-default configuration, but the impact is irreversible data destruction with no recovery path.
Technical ContextAI
Open WebUI (pip/open-webui) is a self-hosted, browser-based UI for interacting with local and cloud LLM backends. Its folder-sharing feature allows users to share chat folders with collaborators at read or write permission levels. The vulnerability resides in backend/open_webui/routers/folders.py, specifically the DELETE /api/v1/folders/{id} handler. The root cause is CWE-862 (Missing Authorization): the handler applied two different authorization policies depending on whether the target folder had a parent. Root folders required ownership or admin role; subfolders required only a write grant - a logical inconsistency that ignored the fact that cascade deletion is bound to the folder owner's identity, not the caller's. Because write grants propagate transitively down the folder tree, a collaborator granted access to the shared root automatically inherited deletion rights over every descendant subfolder, including those never explicitly shared. The affected CPE is pkg:pip/open-webui, versions 0.10.0 through 0.10.x.
RemediationAI
Upgrade to Open WebUI 0.11.0 or later; the fix is confirmed in PR #27003 (https://github.com/open-webui/open-webui/pull/27003) and commit 915ef7d0798d3175819cedbb2f62d7bf0db78c98, and no configuration change is needed after upgrading. If immediate upgrade is not possible, disable the Folders Sharing permission at the admin level by setting user.permissions.sharing.folders to false - this eliminates the attack surface entirely for any version, since the precondition description explicitly states that deployments with folder sharing disabled are unaffected. The trade-off of this workaround is that all cross-user folder collaboration is suspended until the upgrade is applied. Do not rely on restricting individual write grants as a mitigation: because write grants propagate transitively down the folder tree, any existing write-level share is sufficient for exploitation. Single-user instances require no action.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today