PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45671 open-webui CVE debrief

Open WebUI versions prior to 0.9.0 contain an authorization bypass vulnerability that allows any authenticated user to permanently delete files owned by other users. The vulnerability exists in the `has_access_to_file()` function, which unconditionally grants access through its shared-chat branch without verifying the requesting user's identity or the operation type. Attackers can obtain file UUIDs through knowledge base read access, then exploit the weak authorization check to delete arbitrary files referenced in shared chats.

Vendor
open-webui
Product
Unknown
CVSS
HIGH 8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Organizations running self-hosted Open WebUI instances prior to 0.9.0, particularly those with multi-user deployments utilizing shared chats and knowledge bases. Security teams responsible for AI/ML platform governance and data loss prevention.

Technical summary

The `has_access_to_file()` authorization gate in Open WebUI prior to 0.9.0 contains a logic flaw where the shared-chat branch grants access without validating the requester's identity or operation type. This allows authenticated users to execute DELETE operations on files they do not own. File UUIDs are discoverable through `GET /api/v1/knowledge/{id}/files` endpoints, eliminating the practical barrier of UUID unpredictability. The vulnerability is remotely exploitable with low attack complexity, requiring only authenticated access and user interaction (accessing a shared chat).

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Open WebUI to version 0.9.0 or later to remediate this vulnerability
  • Review file access logs for unauthorized DELETE /api/v1/files/{id} requests between deployment and patch date
  • Audit knowledge base access permissions to limit exposure of file UUIDs
  • Implement additional authorization checks for destructive operations on shared resources
  • Monitor for anomalous file deletion patterns in shared chat contexts

Evidence notes

The vulnerability is confirmed by the vendor's security advisory and NVD analysis. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The weakness is classified as CWE-639 (Authorization Bypass Through User-Controlled Key).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45671 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45671

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45671 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45671

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.