What is the CVSS score of EUVD-2026-42628?

EUVD-2026-42628 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-42628?

Yes, a patch is available for EUVD-2026-42628. Update the affected software to the latest version immediately.

Open WebUI EUVD-2026-42628

| CVE-2026-59217 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 security-advisories@github.com

GHSA-7r7x-gjvr-448g

Authentication Bypass File Upload Open Webui Openwebui

4.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable upload endpoint requires an authenticated session (PR:L); only integrity is impacted as read-only users can inject but not otherwise modify knowledge base files.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 18:01 EUVD

Analysis Generated

Jul 09, 2026 - 17:43 vuln.today

DescriptionCVE.org

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledge_id and auto-linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing read-only knowledge-base users to add arbitrary files. This issue is fixed in version 0.10.0.

AnalysisAI

File upload authorization bypass in Open WebUI before 0.10.0 allows authenticated users with read-only knowledge base access to inject arbitrary files into restricted knowledge bases by supplying a crafted metadata.knowledge_id parameter. The upload endpoint omits the write-access check enforced by the dedicated /api/v1/knowledge/<id>/file/add route (CWE-862), creating a privilege escalation path for any authenticated platform user. No public exploit code or CISA KEV listing exists at time of analysis, but the impact extends beyond the low CVSS integrity score - injected content directly influences LLM responses for all users of the affected knowledge base, enabling indirect prompt injection.

Technical ContextAI

Open WebUI is a self-hosted AI interface that manages knowledge bases to augment large language model interactions via retrieval-augmented generation. The platform exposes two distinct code paths for associating files with a knowledge base: a dedicated REST endpoint (/api/v1/knowledge/<id>/file/add) that enforces per-user write-access authorization, and a general-purpose file upload endpoint that accepted a metadata.knowledge_id field and auto-linked uploaded files without invoking the same access check. This inconsistent enforcement is classified as CWE-862 (Missing Authorization) - the authorization model exists and functions correctly on one path but is entirely absent on the secondary path performing the same privileged operation. No CPE identifiers were included in the source data; affected scope is all Open WebUI deployments running versions prior to 0.10.0, per GitHub advisory GHSA-7r7x-gjvr-448g.

RemediationAI

Upgrade to Open WebUI v0.10.0 or later, available at https://github.com/open-webui/open-webui/releases/tag/v0.10.0, which applies the write-access authorization check uniformly to the file upload path. The underlying fix is documented in PR #26001 (https://github.com/open-webui/open-webui/pull/26001) and commit b7626f05fb92b24ab923ad81a037071ebd5623d1. If immediate upgrade is not feasible, restrict knowledge base read access to fully trusted users only - this eliminates the privilege differential that makes the bypass meaningful, though it reduces collaboration. As an additional compensating control, deploying a reverse proxy or WAF rule to strip or reject metadata.knowledge_id parameters from upload requests made by non-administrative roles could prevent exploitation at the network layer, but this approach requires accurate role-to-request mapping and may break legitimate functionality. Audit knowledge base file contents after patching to identify any unauthorized files linked prior to remediation.