CVE-2026-87997 in Open WebUI
Summary
by MITRE • 09/09/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
Open WebUI serves as a self-hosted artificial intelligence platform designed for extensibility and ease of use, allowing users to interact with various large language models through a web interface. The software manages conversations by organizing them into folders, which can be shared among multiple users with varying levels of access permissions. In versions ranging from 0.10.0 up to but not including 0.11.1, the application contained a critical authorization flaw within its backend API endpoints responsible for handling chat completions. Specifically, the POST /api/chat/completions and POST /api/v1/chat/completions routes failed to enforce proper access control checks when associating new chats with existing folders.
The technical root cause of this vulnerability lies in an inconsistency between how different API endpoints handle folder association logic. While dedicated chat management routes correctly verified that the authenticated user possessed write permissions for a target folder before allowing modifications, the chat completion endpoints bypassed these security controls. When a client supplied a folder_id parameter during the creation or update of a chat message, the backend directly copied this identifier into the new chat record without validating whether the current session had sufficient privileges to modify that specific folder. This oversight created an authorization bypass where the application trusted user-supplied input regarding resource ownership rather than verifying actual permissions against the server-side access control lists.
This flaw enables authenticated users who are aware of shared folder identifiers to perform unauthorized actions within those folders. An attacker with read-only or no write access to a specific shared folder could exploit this mechanism by injecting an attacker-controlled chat entry into that folder via the vulnerable API endpoints. Because the system does not validate write permissions for these particular routes, the malicious content is successfully stored and associated with the target folder. Consequently, other authorized users who have legitimate read access to the folder will see the injected chat entries in their view of the shared conversation history. This effectively allows an attacker to pollute or manipulate the context visible to other team members without possessing the requisite administrative rights for that resource.
The operational impact of this vulnerability extends beyond simple data integrity issues, as it facilitates social engineering and potential prompt injection attacks within a collaborative environment. By injecting malicious prompts into shared folders, an adversary can influence how subsequent AI responses are generated by all users viewing that folder, potentially leading to the dissemination of misinformation or the execution of harmful instructions under the guise of legitimate conversation history. This undermines trust in the platform's ability to maintain secure boundaries between user roles and compromises the confidentiality and integrity of collaborative workflows. From a classification perspective, this issue aligns with CWE-269 Improper Privilege Management and represents an Authorization Bypass via User-Controlled Key scenario often associated with ATT&CK technique T1078 Valid Accounts when leveraged by authenticated insiders or compromised credentials.
To mitigate the risks associated with this vulnerability, organizations must ensure that all instances of Open WebUI are upgraded to version 0.11.1 or later, where the developers have implemented proper access control checks for these API endpoints. Until an upgrade is feasible, administrators should restrict network exposure of the application and enforce strict authentication policies to minimize the attack surface. Additionally, monitoring logs for unusual patterns in chat completion requests that reference shared folder identifiers may help detect exploitation attempts in real-time. It is also advisable to review existing user permissions and limit write access only to those who genuinely require it, thereby reducing the potential impact of any future authorization flaws within the application logic.