CVE-2026-87997: Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open WebUIto a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Which deployments are affected?
Open WebUI versions from 0.10.0 through 0.11.1 are identified as affected. The issue applies to deployments where users can authenticate and shared folder identifiers may be known to other users.
What does an attacker need to exploit this issue?
An attacker needs a valid authenticated account and the identifier of a shared folder. They can then submit a chat-completions request with that folder_id, even if they lack write permission for the folder.
What is the impact of successful exploitation?
An attacker can create an attacker-controlled chat in another user's shared folder. The injected chat can appear to users authorized to read that folder, while the vulnerability does not provide confidentiality or availability impact according to the supplied severity vector.
How can this be remediated?
Upgrade Open WebUI to version 0.11.1, which fixes the missing folder write-access check for the affected chat-completions endpoints.