Executive brief
Open WebUI is a framework for managing and interfacing with large language models and knowledge bases. The vulnerability allows ordinary users to delete shared database connections that administrators create and manage, causing service disruption. When a user deletes a knowledge base that uses a shared external database connection, the connection is removed from instance configuration without checking whether other knowledge bases depend on it. This breaks those other knowledge bases' ability to retrieve information until an administrator manually restores the connection with the original credentials.
Technical details
The vulnerability is a missing authorization check in the knowledge base deletion handler (DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py). The handler authorizes the caller against the specific knowledge base (write grant sufficient), then performs an unrelated operation on global configuration—removing the associated external database connection—without checking the caller's role or verifying that other knowledge bases still depend on that connection. The dedicated admin route for deleting connections (DELETE /api/v1/knowledge/external/connections/{id}) correctly performs both checks, but the vulnerability exists because the knowledge base route bypasses them. Exploitation requires the deployment to use external knowledge bases (qdrant, milvus, or pgvector backends) and the attacker to hold write access on at least one knowledge base. Patch 0.11.1 restricts connection removal to administrators and only removes the connection if no other knowledge bases reference it.
Affected products
- open-webui open-webui >= 0.10.0, < 0.11.1
Timeline
- 2026-09-10: disclosed: Published in GitHub Advisory Database
- 2026-09-10: patched: Fixed in version 0.11.1 via PR #28113
References
- https://api.github.com/users/Bellingham-max
- https://github.com/Bellingham-max
- https://api.github.com/users/Bellingham-max/gists%7B/gist_id%7D
- https://api.github.com/users/Bellingham-max/repos
- https://avatars.githubusercontent.com/u/187523831?v=4
- https://api.github.com/users/Bellingham-max/events%7B/privacy%7D