Executive brief
Open WebUI is an interface for interacting with large language models that includes a 'Knowledge Base' feature for uploading documents. A security flaw allows any logged-in user to overwrite or delete the knowledge base collections belonging to other users. This can lead to permanent data loss or 'RAG poisoning,' where an attacker replaces legitimate information with malicious content to manipulate the AI's responses.
Technical details
The 'process_web' and 'process_youtube' endpoints in 'backend/open_webui/routers/retrieval.py' accept a user-supplied 'collection_name' and an 'overwrite' parameter without verifying if the authenticated user has write access to that collection. When 'overwrite' is set to true (the default), the application calls 'delete_collection()' on the target UUID before writing new data. An attacker with a valid account can exploit this by providing the UUID of another user's knowledge base, effectively deleting the victim's data and replacing it with attacker-controlled content. This results in RAG poisoning and can be used for indirect prompt injection. The vulnerability is patched in version 0.9.0.
Affected products
- Open WebUI open-webui <= 0.8.12
Timeline
- 2026-05-05: disclosed: Advisory published on GitHub
- 2026-05-08: advisory: GHSA-7r82-qhg4-6wvj published
- 2026-05-15: advisory: NVD published CVE-2026-44554
- 2026-05-15: patched: Fix confirmed in version 0.9.0