CVE-2026-29070: Open WebUI Auth Bypass Vulnerability

CVE-2026-29070 Overview

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. A missing access control vulnerability was identified in Open WebUI prior to version 0.8.6 that allows authenticated users to delete arbitrary files from any knowledge base within the system. The vulnerability stems from an incomplete authorization check when processing file deletion requests from knowledge bases.

Critical Impact

Authenticated users with write access to any knowledge base can delete files from arbitrary knowledge bases across the system, potentially leading to significant data loss and integrity compromise of AI training data and organizational knowledge repositories.

Affected Products

• Open WebUI versions prior to 0.8.6
• openwebui open_webui (all versions before patch)

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-29070 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-29070

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization). The core issue lies in the file deletion endpoint of Open WebUI's knowledge base management functionality. When a user attempts to delete a file from a knowledge base, the application correctly verifies that the user has write access to the knowledge base or holds administrative privileges. However, the authorization logic fails to validate whether the target file actually belongs to the knowledge base the user is accessing.

This gap in access control creates a situation where an attacker with legitimate write access to one knowledge base can reference file identifiers from completely different knowledge bases and successfully delete those files. The attack requires knowledge of valid file identifiers, which could potentially be obtained through enumeration or information disclosure vulnerabilities.

Root Cause

The root cause is a missing authorization check in the file deletion logic. The application implements a partial access control mechanism that validates user permissions at the knowledge base level but omits the critical step of verifying file-to-knowledge-base association. This incomplete authorization pattern is a common implementation oversight in multi-tenant or resource-hierarchical applications where access control must be enforced at multiple levels of the object hierarchy.

Attack Vector

The attack is network-accessible and requires low-privilege authentication. An attacker must:

1. Authenticate to the Open WebUI platform with credentials that grant write access to at least one knowledge base
2. Identify or enumerate file IDs belonging to target knowledge bases (files the attacker should not have access to)
3. Submit a file deletion request through the knowledge base interface, specifying the target file ID
4. The system processes the deletion based solely on the user's write access to their own knowledge base, without validating that the file belongs to that knowledge base

The vulnerability does not require user interaction and can be exploited programmatically against the API endpoints. The impact primarily affects data integrity and availability, as attackers can destroy files containing critical AI training data, organizational knowledge, or other sensitive information stored in knowledge bases they should not have access to.

Detection Methods for CVE-2026-29070

Indicators of Compromise

• Unusual patterns of file deletion requests where the requesting user's knowledge base differs from the file's parent knowledge base
• Audit log entries showing file deletions from knowledge bases where the acting user has no legitimate business need
• Reports from users about missing files in knowledge bases they manage
• Anomalous spikes in file deletion API calls from individual user accounts

Detection Strategies

• Implement API request logging that captures both the user's authorized knowledge bases and the target file's parent knowledge base for all deletion operations
• Create alerting rules for file deletion requests where the file ID does not match any files within the user's authorized knowledge bases
• Monitor for sequential or bulk file deletion patterns that may indicate enumeration-based attacks
• Deploy application-layer intrusion detection to flag authorization bypass attempts

Monitoring Recommendations

• Enable comprehensive audit logging for all knowledge base file operations including create, read, update, and delete actions
• Correlate user session activity with file deletion events to identify unauthorized cross-knowledge-base access patterns
• Establish baseline metrics for normal file deletion behavior and alert on statistical anomalies
• Review access logs periodically to identify potential exploitation attempts against unpatched instances

How to Mitigate CVE-2026-29070

Immediate Actions Required

• Upgrade Open WebUI to version 0.8.6 or later immediately to address this vulnerability
• Review audit logs for any suspicious file deletion activity that may indicate prior exploitation
• Inventory all knowledge bases and verify file integrity against known-good backups
• Temporarily restrict write access to knowledge bases to trusted administrators until patching is complete

Patch Information

The vulnerability is patched in Open WebUI version 0.8.6. Organizations should upgrade to this version or later as soon as possible. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-26gm-93rw-cchf.

Workarounds

• If immediate patching is not possible, restrict network access to the Open WebUI instance to trusted networks only
• Implement a reverse proxy or web application firewall (WAF) rule to validate that file deletion requests only target files within the user's authorized knowledge bases
• Temporarily disable file deletion functionality at the application or proxy level until the patch can be applied
• Reduce the number of users with write access to knowledge bases to limit potential attack surface

The recommended approach is to apply the official patch by upgrading to version 0.8.6. No specific configuration mitigations can fully address this vulnerability without the code-level fix, so upgrade should be prioritized.