EUVD-2026-75181
GHSA-3pf7-q2g3-wj28
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable API, low complexity, requires authenticated user (PR:L), integrity-only impact via unauthorized folder write injection.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1.
AnalysisAI
Folder write-access bypass in Open WebUI 0.10.0 through 0.11.0 allows authenticated users to inject chats into shared folders where they hold only read-only or no write permission. The chat completion endpoints POST /api/chat/completions and POST /api/v1/chat/completions in main.py accepted a client-supplied folder_id from request metadata and persisted the resulting chat record under that folder without invoking the has_folder_write_access check that the dedicated chat-creation routes enforced. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid Open WebUI account (authenticated, PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) accurately reflects a constrained impact: the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms that exploitation requires prior authentication (PR:L), produces only limited integrity impact (I:L), and does not affect confidentiality or availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Open WebUI to version 0.11.1, which contains the vendor-released patch per the GitHub release at https://github.com/open-webui/open-webui/releases/tag/v0.11.1 and security advisory GHSA-3pf7-q2g3-wj28. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today