Executive Summary

CVE-2026-28788 is a high-severity authorization bypass vulnerability in Open WebUI versions prior to 0.8.6. It occurs because the `POST /api/v1/retrieval/process/files/batch` endpoint allows any authenticated user to overwrite the content of any file by its ID without verifying file ownership.

The vulnerability arises because the endpoint exposes an internal helper function that lacks proper ownership checks. An attacker with read access to a shared knowledge base can enumerate file UUIDs and then overwrite those files, escalating their permissions from read to write.

The overwritten content is then served to the Large Language Model (LLM) via Retrieval-Augmented Generation (RAG), allowing the attacker to control what the model outputs to other users, effectively poisoning the model's responses.

This flaw leads to silent data corruption without audit trails or notifications and is fixed in Open WebUI version 0.8.6 by adding ownership verification before file updates.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Open WebUI to version 0.8.6 or later, where the vulnerability is patched by adding ownership checks before file updates.

Until the upgrade can be applied, restrict access to the vulnerable endpoint `/api/v1/retrieval/process/files/batch` to trusted users only or disable it if possible.

Implement monitoring and alerting on unauthorized file modification attempts and review user permissions to limit read access to shared knowledge bases.

Consider auditing existing files for unauthorized modifications and verify the integrity of knowledge base contents to detect any silent data corruption caused by exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts in multi-user Open WebUI deployments with shared knowledge bases.

• An attacker with only read access can overwrite arbitrary files, escalating their privileges to write access.
• The attacker can poison the LLM's responses by injecting malicious or misleading content, affecting all users relying on the model.
• There is no audit trail or notification of these unauthorized modifications, leading to silent data corruption.
• Depending on deployment, this could lead to further exploitation such as code execution.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for unauthorized file overwrite attempts via the vulnerable endpoint `POST /api/v1/retrieval/process/files/batch`. An attacker first enumerates file UUIDs using the `GET /api/v1/knowledge/{id}/files` endpoint and then sends crafted POST requests to overwrite files.

To detect exploitation attempts, monitor HTTP requests to these endpoints for unusual activity, such as POST requests modifying files without proper ownership.

Suggested commands to detect potential exploitation include using curl or similar tools to query the endpoints and check for unauthorized access patterns:

• Enumerate files in a knowledge base (replace {id} with actual knowledge base ID): curl -X GET -H "Authorization: Bearer <token>" https://<openwebui-host>/api/v1/knowledge/{id}/files
• Check for suspicious POST requests attempting to overwrite files: curl -X POST -H "Authorization: Bearer <token>" -H "Content-Type: application/json" -d '{"file_ids": ["<file-uuid>"], "content": "<test-content>"}' https://<openwebui-host>/api/v1/retrieval/process/files/batch

Additionally, review server logs for POST requests to `/api/v1/retrieval/process/files/batch` from users who should not have write access, as the endpoint lacks ownership verification.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated users to overwrite files they do not own within shared knowledge bases, leading to unauthorized data modification and silent data corruption.

Such unauthorized modification and lack of audit trails can undermine data integrity and accountability requirements commonly mandated by standards and regulations like GDPR and HIPAA.

Specifically, the ability to escalate from read to write access without proper authorization controls may violate principles of least privilege and data protection, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0