CVE-2026-54015: Open WebUI Prompt History Authorization Bypass

Technical summary

The vulnerability stems from an authorization bypass in three prompt history endpoints: /api/v1/prompts/id/{prompt_id}/history/diff, /api/v1/prompts/id/{prompt_id}/update/version, and /api/v1/prompts/id/{prompt_id}/history/{history_id}. These endpoints perform authorization only on the prompt_id extracted from the URL path, validating that the authenticated user owns the prompt. However, the history_id parameter—either explicitly in the path or implicitly in the request payload—is acted upon without cross-referencing to confirm that the history row's prompt_id foreign key matches the accessed prompt. This inconsistency allows an authenticated attacker to supply an arbitrary history_id belonging to another user's prompt and perform read or delete operations on it. The root cause is incomplete object-level access control, classified under CWE-284 (Improper Access Control) and CWE-639 (Authorization with User-Controlled Key).

Business impact

In multi-user or team-based Open WebUI deployments, this vulnerability enables horizontal privilege escalation. Attackers can observe, modify, or erase the development history of competitors' or colleagues' prompts—potentially exposing proprietary AI prompts, learning patterns, or sensitive model interactions stored in version history. Organizations relying on Open WebUI for sensitive research, content generation, or business logic encoded in prompts face confidentiality and integrity risks. The ability to delete history also removes audit trails, complicating forensic investigations and compliance logging.

Affected systems

Open WebUI versions prior to 0.9.6 are affected. This includes all installations running 0.9.5 or earlier. The vulnerability requires multi-user authentication to be enabled; single-user or fully isolated deployments have reduced exposure but should still upgrade. Any organization deploying Open WebUI in a shared or team environment should treat this as affecting their instances.

Exploitability

Exploitation requires an authenticated account with at least one owned prompt. The attacker must discover or enumerate valid history_id values from another user's prompt—not trivial without information disclosure or ID enumeration, but plausible in environments with predictable IDs or partial visibility of prompt metadata. The CVSS score of 6.4 reflects that authentication is mandatory and complexity is moderate, but once prerequisites are met, the impact is significant (confidentiality high, integrity and availability partial). The attack is reliably repeatable without user interaction.

Remediation

Upgrade to Open WebUI version 0.9.6 or later. This release fixes the authorization check to verify that the history_id row's prompt_id matches the prompt being accessed before permitting read, update, or delete operations. Organizations should prioritize patching instances exposed to untrusted users or operating in multi-tenant environments.

Patch guidance

Apply the upgrade to Open WebUI 0.9.6 as soon as operational schedules allow. For containerized deployments, pull the updated image tag (verify against the official Open WebUI release notes). For source-based installations, update your repository and redeploy. Test the upgrade in a non-production environment first to confirm compatibility with your configuration and any customizations. There are no known workarounds; patching is the definitive solution.

Detection guidance

Monitor application logs for repeated requests to /api/v1/prompts/id/*/history/* endpoints with varying history_id parameters where the authenticated user does not own the parent prompt. Watch for delete operations on history endpoints, particularly from accounts with low typical API activity. If you have access to query the database directly, identify any history rows where user_id differs from the prompt owner's user_id—such records would indicate successful exploitation. Implement or enhance logging of history-level access decisions to establish a baseline for your deployment.

Why prioritize this

This vulnerability merits prompt attention because it enables unauthorized access to private data (prompt histories) in a collaborative environment. Although it requires authentication and knowledge of specific history IDs, it directly compromises confidentiality and allows tampering with audit trails. In team-based AI development workflows, leaked or deleted prompt history can represent significant intellectual property loss or compliance violations. The CVSS severity is medium, but business context may elevate the actual risk depending on the sensitivity of prompts stored in your instance.

Risk score, explained

The CVSS 3.1 score of 6.4 (Medium) reflects: Network-based attack vector, authentication required (privileged user role assumed), high complexity (attacker needs knowledge of history IDs and must control a prompt), unchanged scope, high confidentiality impact (full read of prompt history), low integrity impact (deletions or modifications of history), and low availability impact (no system-wide disruption). The score appropriately penalizes the requirement for authentication while acknowledging the significant data exposure and tampering capability once exploited.

Frequently asked questions