EUVD-2026-52899
GHSA-jxc9-xmc4-gr23
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible, low-privilege required; A:L added over vendor's A:N because RAG retrieval availability for affected documents is concretely disrupted, even though underlying files survive.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base. A user with write access to one knowledge base could delete directories and remove file embeddings from another knowledge base, causing documents to drop out of retrieval results and breaking chat-with-file for targeted documents without disclosing contents. This issue is fixed in 0.11.0.
AnalysisAI
Cross-knowledge-base IDOR in Open WebUI 0.9.6-0.10.2 allows any user with write access to one knowledge base to silently delete directories and file embeddings from unrelated knowledge bases they do not control, causing documents to vanish from RAG retrieval results and breaking chat-with-file for targeted files without disclosing their contents. The flaw (CWE-639) sits in the sync cleanup endpoint, which authorized requests based on the URL knowledge base ID but executed destructive operations against object IDs supplied in the request body without verifying those objects belonged to the authorized knowledge base. No public exploit is identified and no CISA KEV listing exists; the vendor released a complete fix in v0.11.0.
Technical ContextAI
The vulnerability resides in backend/open_webui/routers/knowledge.py, handler sync_knowledge_cleanup, serving POST /api/v1/knowledge/{id}/sync/cleanup. Open WebUI is a self-hosted AI frontend for local LLM deployments that implements knowledge bases as RAG (retrieval-augmented generation) data stores (CPE: cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:*). The handler correctly verified write permissions on the knowledge base identified by the URL path parameter {id}, but then iterated over directory and file IDs supplied in the JSON request body, performing deletions without validating that those IDs belonged to the URL-scoped knowledge base. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key): the authorization gate used one key (URL path id) while the privileged operation consumed a different, attacker-controlled key (request body object IDs). The PR diff confirms two loops were affected - directory deletion and per-file vector cleanup - both now patched with explicit knowledge_id membership checks.
RemediationAI
Upgrade Open WebUI to version 0.11.0 or later; this is the complete fix as confirmed by GitHub Security Advisory GHSA-jxc9-xmc4-gr23 (https://github.com/open-webui/open-webui/security/advisories/GHSA-jxc9-xmc4-gr23) and pull request #26722 (commit 707efeaed7992dd9896d5928559458f228b9a539). The patch adds explicit knowledge-base membership validation to both the directory deletion loop and the per-file vector cleanup loop in sync_knowledge_cleanup, ensuring objects are only acted upon if their knowledge_id matches the URL path parameter. As a compensating control prior to patching, administrators can eliminate the exploitation precondition by auditing and revoking cross-user write grants on all shared knowledge bases, or by ensuring no knowledge base is shared beyond its owner - deployments in this state are not reachable by the attack. Note that removing collaborative access grants will disrupt legitimate multi-user knowledge base workflows. The workspace.knowledge setting is already off by default, which limits ordinary user exposure but does not block exploitation by users who already hold write access.
More in Open Webui
View allA vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Sit
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. Rated high severity (CV
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handlin
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF)
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today