CVE-2026-54010: Open WebUI Auth Bypass Vulnerability

CVE-2026-54010 Overview

CVE-2026-54010 is a broken access control vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw affects all versions prior to 0.9.6. An authenticated user can attach arbitrary file_id values to their own chat messages without ownership or read permission checks. By sharing the chat and granting themselves access, the attacker causes has_access_to_file() to treat the victim file as reachable. The file endpoints then read or delete the victim file. The issue is tracked under CWE-284: Improper Access Control and is fixed in version 0.9.6.

Critical Impact
Authenticated attackers can read and delete arbitrary files belonging to other Open WebUI users by abusing chat sharing to bypass file ownership checks.

Affected Products

Open WebUI versions prior to 0.9.6
Self-hosted Open WebUI deployments with multiple authenticated users
Open WebUI instances exposing file attachment and chat sharing features

Discovery Timeline

2026-06-23 - CVE-2026-54010 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54010

Vulnerability Analysis

Open WebUI lets authenticated users attach files to chat messages by supplying file_id references. The server does not verify that the requesting user owns or has read access to the referenced file before storing the attachment on the message object. This creates a Time-of-Check to Time-of-Use gap between attachment and later access enforcement.

When the attacker shares the chat with another principal under their control, the helper function has_access_to_file() evaluates access through the shared chat context. It concludes the victim file is reachable because the file_id is bound to a chat the attacker can read. File endpoints serving read and delete operations then honor those calls against the victim file.

The vulnerability impacts confidentiality and integrity. Attackers exfiltrate arbitrary files indexed by guessable or enumerable file_id values and can also delete those files, causing data loss across tenants on shared deployments.

Root Cause

The root cause is missing authorization at the attachment step. The application trusts client-supplied file_id values when associating files with a chat message, deferring access decisions to a later context-aware check that itself derives authority from the attacker-controlled chat. Authorization should be enforced at the moment a user attempts to reference a file, not inferred from downstream sharing state.

Attack Vector

Exploitation requires only network access and a low-privilege authenticated account. The attacker enumerates or obtains target file_id values, attaches them to a chat message they own, shares the chat with a second account they control, and invokes the file read or delete endpoint through the shared-chat path. No user interaction from the victim is required. See the GitHub Security Advisory GHSA-vrhc-3fr6-pc3c for vendor technical details.

Detection Methods for CVE-2026-54010

Indicators of Compromise

Chat records containing file_id references to files not owned by the chat author
Unexpected file read or delete API calls originating from accounts that do not own the targeted file
Spikes in chat-share creation events followed immediately by file read or delete requests
Application logs showing has_access_to_file() granting access via shared-chat context across user boundaries

Detection Strategies

Audit the chat-message and file-attachment tables for file_id values whose owner differs from the chat author
Correlate file endpoint access logs against the requesting user and the file's true owner to flag cross-user reads and deletes
Alert on rapid sequences of attach, share, and read or delete actions originating from the same user session

Monitoring Recommendations

Enable verbose application logging for file API routes and chat sharing operations in Open WebUI
Forward Open WebUI logs to a centralized log platform and build queries that join user identity, file ownership, and chat-share metadata
Track baseline file deletion rates per user and alert on deviations that may indicate destructive abuse

How to Mitigate CVE-2026-54010

Immediate Actions Required

Upgrade Open WebUI to version 0.9.6 or later on all hosts without delay
Inventory existing chat attachments and identify any file_id references that cross user ownership boundaries
Rotate or revoke API tokens for accounts suspected of abusing the chat sharing or file endpoints
Restrict Open WebUI exposure to trusted networks until the patch is applied

Patch Information

The vendor fixed the issue in Open WebUI 0.9.6. The patch enforces ownership and read-access checks at the point a file_id is attached to a chat message, rather than relying solely on downstream context-aware checks. Review the Open WebUI security advisory GHSA-vrhc-3fr6-pc3c for upgrade guidance.

Workarounds

Disable chat sharing features for non-trusted users until the upgrade is complete
Limit account creation and restrict the platform to a single-tenant deployment where cross-user file exposure is not a concern
Place Open WebUI behind an authenticating reverse proxy that restricts access to a known set of administrators while patching is scheduled

bash

# Upgrade Open WebUI Docker deployment to the patched release
docker pull ghcr.io/open-webui/open-webui:0.9.6
docker stop open-webui
docker rm open-webui
docker run -d \
  --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.9.6