CVE-2026-87997: Open WebUI missing folder write-access check in chat completions

CVE-2026-87997 · Severity: medium · CVSS 4.3 · Published 2026-09-09

Open WebUI is a web interface for interacting with AI chat models, including a folder system to organize conversations. An authenticated attacker can inject chats they create into folders they cannot write to—including shared folders where they only have read access or no access at all. The injected chats appear in those folders for all users who can read them, showing the attacker's name and arbitrary chat content, enabling potential phishing or misinformation attacks in trusted shared workspaces.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-87997 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87997 being exploited in the wild.
How severe is CVE-2026-87997?
Medium severity, with a CVSS score of 4.3, published 9 September 2026.
Which products and versions are affected?
open-webui (PyPI) >= 0.10.0, < 0.11.1, ECOSYSTEM:introduced=0.10.0,fixed=0.11.1.
Is there a fix for CVE-2026-87997?
Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87997 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-87997?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.11.1 or later
    pip install "open-webui>=0.11.1"

Technical details

The vulnerability is a missing authorization check (CWE-862, CWE-639) in the chat-completions handler at POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py. The endpoint accepts a folder ID in the request body and creates a chat in that folder without verifying the authenticated user has write access to it. Other chat endpoints (dedicated chat-creation and chat-move) correctly enforce this check, but the chat-completions path—which gained its own chat-creation branch—copied the vulnerable pattern. An attacker must be authenticated and know the target folder's ID (obtainable if the folder is shared); they can then create a chat visible to all folder members, controllable by the attacker and potentially containing misleading content. The fix in version 0.11.1 unifies the folder write-access check across all three chat-creation paths.

Affected products

  • Open WebUI Open WebUI 0.10.0 through 0.11.0

Identifiers

  • CVE-2026-87997
  • GHSA-3pf7-q2g3-wj28
  • PYSEC-2026-4118

Timeline

  • 2026-09-10: disclosed: Advisory published by GitHub
  • 2026-09-10: patched: Fix released in version 0.11.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.