Executive brief
Open WebUI is a web interface for interacting with AI chat models, including a folder system to organize conversations. An authenticated attacker can inject chats they create into folders they cannot write to—including shared folders where they only have read access or no access at all. The injected chats appear in those folders for all users who can read them, showing the attacker's name and arbitrary chat content, enabling potential phishing or misinformation attacks in trusted shared workspaces.
Technical details
The vulnerability is a missing authorization check (CWE-862, CWE-639) in the chat-completions handler at POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py. The endpoint accepts a folder ID in the request body and creates a chat in that folder without verifying the authenticated user has write access to it. Other chat endpoints (dedicated chat-creation and chat-move) correctly enforce this check, but the chat-completions path—which gained its own chat-creation branch—copied the vulnerable pattern. An attacker must be authenticated and know the target folder's ID (obtainable if the folder is shared); they can then create a chat visible to all folder members, controllable by the attacker and potentially containing misleading content. The fix in version 0.11.1 unifies the folder write-access check across all three chat-creation paths.
Affected products
- Open WebUI Open WebUI 0.10.0 through 0.11.0
Timeline
- 2026-09-10: disclosed: Advisory published by GitHub
- 2026-09-10: patched: Fix released in version 0.11.1