Executive brief
Open WebUI, a user interface for large language models, contains a vulnerability where users with write access to one knowledge base can delete data from others. An attacker could remove directories and file embeddings belonging to other users, causing documents to disappear from search results and chat sessions. While the original files remain in the database, this can disrupt operations and require manual restoration by the data owner.
Technical details
The vulnerability is an authorization bypass (CWE-639, CWE-863) in the `sync_knowledge_cleanup` handler within `backend/open_webui/routers/knowledge.py`. The endpoint `POST /api/v1/knowledge/{id}/sync/cleanup` verified write access for the knowledge base ID provided in the URL but failed to verify that the directory and file IDs provided in the request body actually belonged to that specific knowledge base. An attacker with write access to at least one knowledge base (and knowledge of target UUIDs) can trigger the deletion of directory structures and vector collections for files in other knowledge bases. This results in the removal of `knowledge_file` associations and breaks 'chat-with-file' functionality. The issue is fixed in version 0.11.0 by scoping all request-body operations to the knowledge base ID specified in the URL.
Affected products
- Open WebUI open-webui >= 0.9.6, <= 0.10.2
Timeline
- 2026-08-02: disclosed
- 2026-08-04: advisory: GHSA-jxc9-xmc4-gr23 published
- 2026-08-04: patched: Fixed in version 0.11.0