Executive Summary

CVE-2026-54015 is a security vulnerability in Open WebUI versions 0.9.5 and earlier involving an Insecure Direct Object Reference (IDOR) in the prompt version-history endpoints.

The system authorizes access based on the prompt ID in the URL but fails to verify that the referenced history entries actually belong to that specific prompt.

This flaw allows an authenticated user who controls any prompt, and who knows a victim's prompt history ID, to read or delete another user's private prompt history.

The affected endpoints include operations to view diffs of history snapshots, update or restore versions, and delete history entries.

The root cause is that while the route checks access for the prompt ID, it does not enforce ownership verification on the history entries being accessed or modified.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated user to access or delete your private prompt history without your permission.

Specifically, an attacker can read confidential prompt history data, potentially exposing sensitive information.

Additionally, the attacker can delete or restore prompt history entries, which affects the integrity and availability of your data.

The vulnerability has a medium severity CVSS score of 6.4, indicating a significant risk to confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the affected Open WebUI endpoints for improper access control on prompt history entries. Specifically, you can attempt to access or manipulate prompt history entries using the endpoints /api/v1/prompts/id/{prompt_id}/history/diff, /api/v1/prompts/id/{prompt_id}/update/version, and /api/v1/prompts/id/{prompt_id}/history/{history_id} with prompt IDs and history IDs that do not belong to the authenticated user.

Suggested commands involve making authenticated HTTP requests to these endpoints with different prompt_id and history_id values to verify if unauthorized access or modification is possible. For example, using curl:

• GET request to check history diff: curl -X GET -H "Authorization: Bearer <token>" https://<host>/api/v1/prompts/id/<prompt_id>/history/diff
• POST request to update version: curl -X POST -H "Authorization: Bearer <token>" -d '{"version": "<version_data>"}' https://<host>/api/v1/prompts/id/<prompt_id>/update/version
• DELETE request to remove history entry: curl -X DELETE -H "Authorization: Bearer <token>" https://<host>/api/v1/prompts/id/<prompt_id>/history/<history_id>

By substituting prompt_id and history_id values that belong to other users, you can test if the system improperly allows access or deletion of another user's prompt history, indicating the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Open WebUI to version 0.9.6 or later, where this vulnerability has been fixed.

Until the upgrade can be applied, restrict access to the affected endpoints to trusted users only, and monitor for suspicious activity involving prompt history operations.

Additionally, review and enforce strict access control checks on prompt history operations to ensure that history entries belong to the authorized prompt before allowing read, update, or delete actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated users to read or delete another user's private prompt history due to improper authorization checks. Such unauthorized access and modification of private data can lead to violations of data protection principles required by standards like GDPR and HIPAA, which mandate strict controls over personal and sensitive information to ensure confidentiality and integrity.

Specifically, the exposure and potential deletion of private prompt histories could be considered a breach of confidentiality and data integrity, which are core requirements under these regulations. Organizations using affected versions of Open WebUI prior to 0.9.6 may therefore face compliance risks if this vulnerability is exploited.

Useful 0 Not Useful 0