Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared…
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Record
- CVE-2026-70494
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- September 18, 2026
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The cascade following the authorization check is bound to the folder owner's id, but the subfolder check accepted any inherited write grant instead of requiring ownership or administrator status. A collaborator can destroy the owner's subtree or force-move chats out of it when delete_contents=false. This issue is fixed in 0.11.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a self-hosted program that gives people a chat window for working with AI language models. This flaw affects versions 0.10.0 up to, but not including, 0.11.0, in the feature that lets people share chat folders with each other. Someone who has been given permission to make changes in a shared folder can permanently delete chats and messages that belong to the folder's owner. They can also force the owner's chats to move out of the folder. This flaw is rated High.
What to do
- If a person in your organization installed and looks after Open WebUI, ask them to check which version is running.
- If the version is 0.10.0 or later but older than 0.11.0, that person should update it to
0.11.0, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to
0.11.0will be done. - For the update steps, see the vendor advisory linked on this page.
Analysis written from the source record as of September 18, 2026 and reviewed before publishing.