Open WebUI: Shared-chat branch ignores access_type, allowing unauthorized file deletion
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.0
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Record
- CVE-2026-45671
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user can permanently delete files owned by other users via DELETE /api/v1/files/{id} when the target file is referenced in any shared chat. The has_access_to_file() authorization gate unconditionally grants access through its shared-chat branch. It checks neither the requesting user's identity nor the type of operation being performed. File UUIDs (which would otherwise be impractical to guess) are disclosed to any user with read access to a knowledge base via GET /api/v1/knowledge/{id}/files. This vulnerability is fixed in 0.9.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a self-hosted chat website that lets people in your organization use AI language models, and it can run entirely offline. This flaw affects versions before 0.9.0. Any user who can sign in could permanently delete files that belong to other users, as long as the file appears in any shared chat. The permission check for shared chats does not look at who is asking or what they want to do. The hard-to-guess file codes needed for this are shown to any user who can read a knowledge base (a shared collection of documents). This flaw is rated High.
What to do
- Find out who runs Open WebUI for your organization: the person who installed it, or an IT provider or vendor who manages it for you.
- If someone on your staff runs it, have that person check which version is in use. If it is
0.9.0or later, this flaw does not affect you. - If the version is older, update Open WebUI to
0.9.0or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update to
0.9.0will be done.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.