p PatchFirst

CVE-2026-87997

CVE-2026-87997 · Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1.

CVSS 4.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • open-webui

    Versions
    • >= 0.10.0, < 0.11.1: Affected

    No fix published

  • open-webui PyPI

    Versions
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.11.0
    Affected ranges
    • ECOSYSTEM: ≥ 0.10.0, < 0.11.1

    Update to 0.11.1

Original sources

Check your server →