Executive brief
Open WebUI, a user interface for managing AI chat models, contains a flaw in its folder sharing system. A user who has been granted 'write' access to a shared folder can permanently and irreversibly delete the original owner's chat history and subfolders. This could lead to significant data loss for users who collaborate on shared chat projects.
Technical details
An incorrect authorization vulnerability exists in the `DELETE /api/v1/folders/{id}` handler within `backend/open_webui/routers/folders.py`. The application incorrectly branched authorization logic: while root folders required ownership or admin privileges, subfolders only required 'write' access. Because write permissions propagate down the folder tree, a collaborator could trigger a cascading deletion that targets the owner's data instead of the caller's. This allows an authenticated attacker with shared write access to permanently destroy the owner's chat history and subfolder structure. The issue is fixed in version 0.11.0 by unifying the authorization check to require ownership or admin status for all folder deletions.
Affected products
- Open WebUI Open WebUI >= 0.10.0, < 0.11.0
Timeline
- 2026-08-02: patched: Fixed in version 0.11.0
- 2026-08-04: advisory: GitHub Advisory published