CVE-2026-70494 in Open WebUI
Summary
by MITRE • 08/05/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The cascade following the authorization check is bound to the folder owner's id, but the subfolder check accepted any inherited write grant instead of requiring ownership or administrator status. A collaborator can destroy the owner's subtree or force-move chats out of it when delete_contents=false. This issue is fixed in 0.11.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability exists within the Open WebUI platform's folder management system where a privilege escalation flaw allows unauthorized deletion of chat content. This issue affects versions between 0.10.0 and 0.11.0, specifically targeting the DELETE /api/v1/folders/{id} endpoint in the backend routers. The core problem lies in the inconsistent authorization logic where the system properly validates folder ownership for the cascade operation but fails to enforce strict ownership requirements during subfolder checks.
The technical flaw stems from a mismatch in access control validation mechanisms within the folders.py router implementation. While the primary authorization check correctly binds the deletion operation to the folder owner's identifier, the secondary subfolder validation accepts any inherited write grant rather than enforcing mandatory ownership or administrator privileges. This design inconsistency creates a path where collaborators with write permissions can exploit the system to delete content belonging to other users.
The operational impact of this vulnerability extends beyond simple data loss scenarios as it enables malicious actors or unauthorized collaborators to perform destructive operations on shared chat folders. When delete_contents parameter is set to false, the collaborator can still force-move chats out of the target folder structure, effectively corrupting the owner's content organization and potentially leading to information leakage through forced reorganization. This behavior violates fundamental principles of data integrity and user privacy within collaborative environments.
This vulnerability aligns with CWE-284 Access Control Issues, specifically manifesting as improper access control during resource deletion operations. The flaw demonstrates characteristics consistent with ATT&CK technique T1485 Data Destruction where unauthorized users can manipulate system resources to cause permanent data loss or corruption. The issue represents a critical authorization bypass that undermines the platform's security model for shared content management.
The fix implemented in version 0.11.0 addresses this by strengthening the subfolder validation logic to require explicit ownership or administrator privileges before allowing deletion operations. This change ensures that only folder owners or system administrators can perform destructive actions on chat folders, eliminating the possibility of unauthorized content manipulation through inherited write permissions. The remediation approach follows security best practices for privilege escalation prevention and demonstrates proper defense-in-depth principles in access control enforcement.
Organizations using Open WebUI should immediately upgrade to version 0.11.0 or later to mitigate this vulnerability, as it represents a significant risk to data integrity and user privacy in collaborative environments where multiple users share chat folders. The fix reinforces proper access control boundaries and prevents unauthorized deletion of content that belongs to other users within the shared folder structure.