Log in Start free

Vulnerability · Published Aug 4, 2026 · Assigned by GitHub_M

CVE-2026-70494Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

High 8.1

In plain English

A high-severity missing authorization in open-webui from open-webui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 53.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The cascade following the authorization check is bound to the folder owner's id, but the subfolder check accepted any inherited write grant instead of requiring ownership or administrator status. A collaborator can destroy the owner's subtree or force-move chats out of it when delete_contents=false. This issue is fixed in 0.11.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIopen-webui0.11.0GHSA-3cg5-48j3-v4gv
PyPIopen-webui0.11.0PYSEC-2026-3638

Affected products (as reported)

VendorProductVersions
open-webui open-webui >= 0.10.0, < 0.11.0

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References