CVE-2026-87997

Undergoing Analysis Undergoing Analysis - In Progress

Open WebUI Chat Injection via Folder ID

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87997

EUVD

EUVD-2026-75181

Affected Vendors & Products

Vendor	Product	Version / Range
open_webui	open_webui	to 0.11.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Open WebUI versions 0.10.0 to 0.11.1 had a flaw in the chat completion endpoints where a user could supply a folder_id without proper write-access checks. This allowed an authenticated user to inject a chat into a folder they did not have write access to, making it visible to authorized folder readers.

Detection Guidance

This vulnerability can be detected by checking the Open WebUI version. If your system is running a version between 0.10.0 and 0.11.0, it is vulnerable. Use the command: curl -s http://localhost:8080/api/version | grep version to check the installed version.

Impact Analysis

An attacker with access could place malicious or unauthorized content in a restricted folder, potentially exposing sensitive data to unintended users or violating access controls.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to improper access controls and potential data leaks.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.1 or later to address the vulnerability. Ensure all instances are updated to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-87997. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70