CVE-2026-87998

Undergoing Analysis Undergoing Analysis - In Progress

Unauthorized External Knowledge Base Deletion in Open WebUI

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable. This issue is fixed in version 0.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-87998

EUVD

EUVD-2026-75183

Affected Vendors & Products

Vendor	Product	Version / Range
open_webui	open_webui	to 0.11.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Open WebUI allows non-administrator users with write access to delete an external knowledge base connection. The issue occurs because the system removes the connection without checking if it is administrator-owned or if other knowledge bases depend on it. This can cause shared instance configurations to be deleted and make other knowledge bases using that connection unavailable.

Detection Guidance

This vulnerability affects Open WebUI versions 0.10.0 to 0.11.1. To detect it, check the installed version of Open WebUI by running: curl -s http://localhost:8080/api/version or inspect the version file in the application directory. If the version is between 0.10.0 and 0.11.1, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow a non-admin user to disrupt shared resources by deleting external connections. This may cause other users' knowledge bases to become unavailable, leading to data loss or service disruption for dependent users or services.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to delete shared instance configurations and external connections. This may lead to data loss or unauthorized access to sensitive information, which are critical violations under these regulations.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.1 or later to address the vulnerability. Ensure only trusted users have write access to external knowledge bases.

Hi! I’m here to help you understand CVE-2026-87998. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70