CVE-2026-59212: Open WebUI Knowledge File Authorization Bypass (CVSS 5.4)

Technical summary

CVE-2026-59212 is an authorization bypass (CWE-863) affecting Open WebUI versions 0.9.6 before 0.10.0. The _verify_knowledge_file_access function validates read access to knowledge files but does not enforce the same restrictions on write and delete operations. Downstream routes that handle file write and delete requests rely on writable model meta.knowledge entries without re-validating the caller's permissions. This trust boundary violation allows a read-only user to craft requests that supply elevated access claims, bypassing the intended access control model. The vulnerability requires authentication and network access but does not require user interaction.

Business impact

Organizations deploying Open WebUI for collaborative AI workflows face data integrity and confidentiality risks. Users intended to have read-only access to shared knowledge bases can now delete or modify sensitive files, leading to data loss, corruption of training datasets, or unauthorized alteration of organizational knowledge. In regulated environments, this privilege escalation could violate compliance requirements around data integrity and access controls. The impact is confined to the affected instance and requires existing user credentials, limiting organization-wide blast radius but increasing insider risk.

Affected systems

Open WebUI versions 0.9.6 through 0.9.x are vulnerable. Version 0.10.0 and later contain the fix. Self-hosted deployments are affected; no managed or cloud-hosted versions are documented as impacted by this release timeline. Environments where multiple users share access to knowledge files are at highest risk, particularly those relying on role-based access controls to enforce data governance.

Exploitability

Exploitation requires valid authentication credentials and is not known to be actively weaponized (CVE is not on the CISA Known Exploited Vulnerabilities catalog as of publication). The attack is straightforward once an attacker has valid read-only user credentials: they can issue API calls to write or delete endpoints with crafted metadata claims. No special tooling or user interaction is required. The CVSS 3.1 score of 5.4 (Medium) reflects the authentication requirement and limited scope (integrity and availability only; no confidentiality impact), though the ease of execution once inside warrants prompt remediation.

Remediation

Upgrade Open WebUI to version 0.10.0 or later. This version implements proper authorization checks across all file access operations, ensuring that write and delete permissions are validated consistently with read access. Organizations should prioritize patching instances where collaborative or multi-tenant knowledge file sharing is in use. Until patching is feasible, restrict write-capable user roles and regularly audit knowledge file modification logs to detect unauthorized changes.

Patch guidance

Download and deploy Open WebUI 0.10.0 from the official repository. Verify that the version string reflects 0.10.0 or higher in the application settings or logs post-deployment. No breaking changes or additional configuration is documented for this update; standard upgrade procedures apply. Test in a staging environment first if your deployment includes customizations or integrations. Backup knowledge files before upgrading in case rollback is needed.

Detection guidance

Monitor API access logs for requests to knowledge file write and delete endpoints originating from users or service accounts with read-only role assignments. Look for mismatches between caller permissions and operation type (e.g., DELETE requests from read-only accounts). Inspect application audit logs for unauthorized file modifications or deletions by low-privilege users. File integrity monitoring on knowledge data directories can alert to unexpected changes. Network-level detection should focus on rate anomalies in file operation requests from single users.

Why prioritize this

Although rated Medium severity, this vulnerability should be prioritized in environments where knowledge files contain sensitive organizational data, trade secrets, or training datasets. The low complexity and authentication-only requirement make it a plausible insider or compromised-account attack vector. Organizations with strict data governance or multi-tenant deployments should upgrade within 30 days. Isolated, single-user Open WebUI instances face lower risk.

Risk score, explained

CVSS 3.1 score 5.4 reflects a Medium severity: authentication is required (reducing exploitability), the attack vector is network-based (typical for web apps), and impact is limited to integrity and availability of knowledge files, not confidentiality. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L acknowledges low attack complexity and no user interaction but appropriately penalizes the need for prior login and the scoped impact. In practice, organizations handling sensitive data via knowledge files should treat this as higher business risk than the numeric score alone suggests.

Frequently asked questions