Open WebUI EUVD-2026-75183

Exploitation requires a valid Open WebUI user account with write access to at least one knowledge base that is backed by an external vector store connection (i.e., connection_id is set for the knowledge base). The attacker must be authenticated (PR:L per CVSS). The vulnerability is specifically triggered when the knowledge base targeted for deletion references an administrator-configured external connection that is also shared by other knowledge bases on the instance. Open WebUI instances where knowledge bases do not use external connections, or where only one knowledge base references a given connection, are not susceptible to the cross-knowledge-base availability impact (though the unauthorized deletion of the connection itself still occurs). Limiting factors: (1) valid account is required - anonymous access is insufficient; (2) the knowledge base must reference an external connection; (3) affected version range is strictly 0.10.0 to <0.11.1.

The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) reflects a network-exploitable, low-complexity attack requiring only low-privilege authentication with no user interaction - a reliable exploitation profile. The I:H rating correctly captures the integrity impact of destroying shared admin-owned configuration, though the A:L designation understates operational impact: disabling all knowledge bases that share the affected external connection is arguably a high availability event for organizations whose workflows depend on that infrastructure. Even a mid-sized municipal IT team in legnica running Open WebUI for document retrieval would face complete disruption of their knowledge retrieval workflows if this deletion cascades across multiple knowledge bases. EPSS data is not provided in the available intelligence, so quantified exploitation probability is unavailable; the CVE is not in the CISA KEV catalog and no public exploit code has been identified, suggesting this has not seen opportunistic exploitation in the wild. The realistic risk is highest in multi-user, multi-team deployments where external connections are shared - single-user or small-team instances where external connections are not used may not be affected by the cascade at all.

An authenticated low-privilege Open WebUI user with write access to any knowledge base sends a DELETE request to /api/v1/knowledge/{id}/delete targeting their own knowledge base. Because the endpoint does not verify the caller's admin role before removing the underlying external connection, the shared vector store connection is permanently deleted. All other knowledge bases on the instance that reference that same external connection immediately become unavailable, constituting a denial-of-service against the broader user population. No public exploit code has been identified, but the attack is straightforward to reproduce given the commit diff makes the vulnerable code path unambiguous.