CVE-2026-59217: Open WebUI Authorization Bypass in File Upload – Knowledge Base Poisoning Risk

Technical summary

The vulnerability exists in Open WebUI's file upload endpoint prior to version 0.10.0. The endpoint processes a metadata.knowledge_id parameter during file upload and automatically associates uploaded files with the specified knowledge base. Unlike the /api/v1/knowledge/{id}/file/add endpoint, which enforces write-access checks before allowing file associations, the upload path skips this authorization validation. An authenticated user with read-only access to a knowledge base can exploit this by crafting a file upload request with a knowledge_id parameter pointing to a protected knowledge base, bypassing the intended access controls. The flaw is rooted in inconsistent authorization logic across different API code paths (CWE-862: Missing Authorization, CWE-863: Incorrect Authorization).

Business impact

This vulnerability enables privilege escalation within Open WebUI deployments. Users confined to read-only roles can covertly add files to shared knowledge bases, potentially compromising the integrity of AI training data, poisoning knowledge bases used by other users or the AI model itself, and undermining the role-based access control model that organizations rely on to compartmentalize sensitive information. In multi-tenant or team environments, this could allow one team or user to inject malicious or misleading content into knowledge bases belonging to others, with downstream effects on AI model output quality and trustworthiness.

Affected systems

Open WebUI versions prior to 0.10.0 are affected. Any deployment where knowledge bases are shared across multiple users with differentiated access levels (some read-only, some read-write) is at risk. Self-hosted instances are the primary deployment model; the vulnerability does not affect managed SaaS deployments of Open WebUI if such exist.

Exploitability

Exploitability is straightforward. The vulnerability requires only a valid user account with network access to the Open WebUI instance—no special privileges or user interaction needed. An attacker with even read-only access can immediately exploit the flaw by issuing a direct API request with a crafted metadata.knowledge_id parameter pointing to a restricted knowledge base. Proof-of-concept is trivial: a simple HTTP POST to the upload endpoint with the knowledge_id parameter set to a target knowledge base ID. No zero-click or complex chaining is necessary, making this a low-friction attack.

Remediation

Upgrade Open WebUI to version 0.10.0 or later. This release patches the authorization bypass by applying consistent write-access checks to all file upload paths, including the metadata.knowledge_id parameter processing. Organizations running older versions should prioritize this upgrade, especially if they operate multi-user deployments with role-based access controls.

Patch guidance

Apply the patch by updating to Open WebUI 0.10.0 or any stable release after that version. Verify the update through your package manager or by reviewing the release notes at the Open WebUI project repository to confirm the authorization fix is included. If you maintain custom deployments or forks, backport the authorization checks to ensure consistency across all file-upload code paths. Test the patched version in a non-production environment first to confirm knowledge base access controls are correctly enforced post-upgrade.

Detection guidance

Monitor for suspicious file upload activity targeting knowledge bases where the uploading user lacks write permissions. Log analysis should flag cases where metadata.knowledge_id values in upload requests differ from the user's permitted knowledge base list. If your Open WebUI instance supports audit logging, review upload logs for read-only users associating files with knowledge bases outside their assigned scope. Network-level detection is challenging because the requests are legitimate API calls; focus on application-level access logs and knowledge base audit trails for unauthorized file associations.

Why prioritize this

Although the CVSS score is moderate (4.3), this vulnerability merits prompt attention because it directly undermines role-based access control—a foundational security assumption in multi-user systems. The ease of exploitation combined with the risk of knowledge base poisoning and integrity compromise justifies prioritization above the base score. Organizations relying on knowledge bases for sensitive AI training data or as sources of truth for other users should treat this as high-priority within their patching workflow.

Risk score, explained

The CVSS:3.1 score of 4.3 (MEDIUM) reflects that the vulnerability is network-accessible from any authenticated user (AV:N, PR:L), requires no user interaction (UI:N), does not require privilege escalation prerequisites beyond read-only access (AC:L), and causes integrity impact only (I:L)—not confidentiality or availability. The score does not fully capture the reputational or operational risk of knowledge base poisoning in multi-user AI systems, so organizations should consider context-specific factors when prioritizing remediation.

Frequently asked questions