Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers.
This issue is fixed in version 0.11.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/open-webui/open-webui/commit/d9e23b90c100d19b00270aea3cde050…
security-advisories@github.com
https://github.com/open-webui/open-webui/pull/28366
security-advisories@github.com
https://github.com/open-webui/open-webui/releases/tag/v0.11.1
security-advisories@github.com
https://github.com/open-webui/open-webui/security/advisories/GHSA-3pf7-q2g3-wj28
security-advisories@github.com