Executive brief
Open WebUI, a popular interface for interacting with large language models, contains a flaw that allows any logged-in user to create folders in other users' accounts. By exploiting this, an attacker can plant misleading folders or spam a victim's workspace with unwanted content. This could be used for phishing attacks by naming folders with deceptive security alerts or account recovery instructions.
Technical details
A mass assignment vulnerability exists in the folder creation logic of Open WebUI due to the use of Pydantic's 'extra=allow' configuration in the FolderForm model. In the 'insert_new_folder' function, user-supplied form data is spread into a dictionary after the server-assigned 'user_id' has been set, allowing the attacker-provided 'user_id' to overwrite the legitimate one. An authenticated attacker who knows a victim's UUID can send a crafted POST request to the /api/v1/folders/ endpoint to inject folders into the victim's account. This can be used for phishing or denial-of-service (spam), though the attacker cannot read the contents of the victim's existing folders. The issue is fixed in version 0.9.0.
Affected products
- Open WebUI Open WebUI <= 0.8.12
Timeline
- 2026-05-05: disclosed
- 2026-05-08: advisory
- 2026-05-15: other: NVD published