CVE-2026-87998 in Open WebUI
Summary
by MITRE • 09/09/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable. This issue is fixed in version 0.11.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within Open WebUI versions ranging from 0.10.0 through 0.11.1 represents a critical failure in access control logic, specifically manifesting as an insecure direct object reference combined with insufficient authorization checks during resource deletion operations. The application serves as a self-hosted artificial intelligence platform that allows users to manage various knowledge bases and external connections for data retrieval. While the system correctly restricts certain administrative functions based on user roles, it fails to enforce proper separation of duties when handling dependencies between different types of resources. Specifically, the endpoint responsible for deleting individual knowledge base entries does not adequately validate whether the action will impact shared infrastructure components that require elevated privileges to modify or remove.
The technical flaw resides in the backend implementation located within the routers/knowledge.py module, specifically targeting the DELETE /api/v1/knowledge/{id}/delete route. When a user with write access to a specific knowledge base initiates a deletion request, the application proceeds to remove that particular entry from the database. However, immediately following this operation, the code attempts to clean up associated external connections. In scenarios where multiple knowledge bases share a single external connection configuration, or when that connection is designated as administrator-owned for broader system functionality, the deletion logic erroneously removes the shared resource without verifying if other active dependencies rely on it. This lack of dependency analysis means that any user with write permissions to even one non-administrative knowledge base can inadvertently trigger the removal of critical infrastructure settings intended only for administrative management.
The operational impact of this vulnerability is severe, leading to a denial-of-service condition for legitimate users and potential data unavailability across the platform. By deleting an administrator-owned external connection without proper authorization checks or dependency validation, a lower-privileged user effectively breaks the connectivity for all other knowledge bases that utilize that same shared configuration. This results in every dependent knowledge base becoming unavailable until the administrative staff manually restores the connection settings. Beyond immediate service disruption, this behavior exposes sensitive system configurations to unauthorized modification and deletion, undermining the integrity of the platform's data retrieval mechanisms and potentially exposing underlying infrastructure details if error messages or logs are accessible to lower-privileged users during the failure state.
This issue aligns with Common Weakness Enumeration standards such as CWE-269 Improper Privilege Management and CWE-732 Incorrect Permission Assignment for Critical Resource, as it involves granting capabilities that exceed the user's intended role without adequate safeguards against side effects on shared resources. From a tactical perspective, this vulnerability facilitates privilege escalation by allowing lower-level users to disrupt system functionality, which can be categorized under ATT&CK techniques related to Impact and Defense Evasion, specifically impacting availability through resource destruction or configuration alteration. The attack vector is remote and requires only authenticated access with write privileges to any single knowledge base, making it particularly dangerous in multi-tenant environments where trust boundaries between users are not strictly enforced at the dependency level.
To mitigate this vulnerability, organizations must upgrade Open WebUI to version 0.11.1 or later, which contains the necessary code corrections to enforce proper authorization checks before removing shared external connections. In addition to upgrading, administrators should review their access control policies to ensure that write permissions for knowledge bases do not implicitly grant influence over shared infrastructure components if such separation is required by organizational security standards. Implementing stricter role-based access controls where only users with explicit administrative privileges can modify or delete global connection settings will further reduce the risk of accidental or malicious disruption. Regular auditing of dependency mappings between user-managed resources and system-level configurations is also recommended to identify similar architectural flaws in other parts of the application before they are exploited.