CVE-2026-70494: Open WebUI Privilege Escalation Flaw

CVE-2026-70494 Overview

CVE-2026-70494 is a missing authorization vulnerability [CWE-862] in Open WebUI, a self-hosted AI platform. The flaw affects the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py across versions 0.10.0 through 0.10.x. A collaborator granted write access to a shared chat folder can permanently delete chats, messages, and subfolders belonging to the folder owner. The authorization check accepted any inherited write grant on a subfolder instead of requiring ownership or administrator status. The issue is fixed in version 0.11.0.

Critical Impact
Authenticated users with write access to a shared folder can destroy the owner's chat subtree or force-move chats out of it, resulting in irreversible data loss.

Affected Products

Open WebUI 0.10.0
Open WebUI versions from 0.10.0 up to (but not including) 0.11.0
Self-hosted Open WebUI deployments using shared folder collaboration

Discovery Timeline

2026-08-04 - CVE-2026-70494 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70494

Vulnerability Analysis

Open WebUI supports shared chat folders where the owner can grant collaborators read or write access. The DELETE /api/v1/folders/{id} endpoint first attempts to look up the folder scoped to the calling user's identifier. When that lookup fails, meaning the caller is not the owner, the handler falls back to a permission check that accepted any inherited write grant on a subfolder. The delete cascade, however, executes against the folder owner's identifier and removes the owner's chats and nested folders.

This mismatch between the authorization scope and the cascade scope allows a collaborator to trigger destructive operations outside their intended privilege boundary. When delete_contents=false is supplied, the collaborator can also force-move the owner's chats out of the subtree.

Root Cause

The root cause is broken access control on a destructive endpoint. The subfolder branch of the authorization logic treated inherited write access as sufficient to delete, while the cascade downstream operated against the owner's data. Only the owner or an administrator should be authorized to invoke a cascading delete.

Attack Vector

An authenticated user with write access to any shared folder issues a DELETE request against a subfolder identifier owned by another user. The pre-patch code path routes the request through the folder.parent_id branch, accepts the write grant, and executes the cascade against the owner's records. No user interaction from the owner is required.

python

     folder = await Folders.get_folder_by_id_and_user_id(id, user.id, db=db)
 
     if not folder:
-        # Check if it's a shared subfolder with write access
+        # Deletion cascades into the owner's data, so only the owner or an admin may delete
         folder = await Folders.get_folder_by_id(id, db=db)
-        if folder and folder.parent_id:
-            if user.role != 'admin' and not await _has_folder_access(user.id, folder, 'write', db):
-                raise HTTPException(
-                    status_code=status.HTTP_403_FORBIDDEN,
-                    detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
-                )
-        elif folder and not folder.parent_id:
-            # Root shared folders can only be deleted by owner/admin
-            if user.role != 'admin':
-                raise HTTPException(
-                    status_code=status.HTTP_403_FORBIDDEN,
-                    detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
-                )
-        else:
+        if not folder:
             raise HTTPException(
                 status_code=status.HTTP_404_NOT_FOUND,
                 detail=ERROR_MESSAGES.NOT_FOUND,
             )
+        if user.role != 'admin':
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+            )

Source: GitHub Commit 915ef7d. The patch removes the inherited-write branch and requires either ownership or admin role for folder deletion.

Detection Methods for CVE-2026-70494

Indicators of Compromise

DELETE requests to /api/v1/folders/{id} where the authenticated user is not the folder owner and lacks the admin role.
Unexpected disappearance of chats, messages, or subfolders reported by Open WebUI users who own shared folders.
Chat records reassigned to a new parent folder shortly after a collaborator issued a folder delete with delete_contents=false.

Detection Strategies

Enable audit logging on the Open WebUI backend and parse access logs for DELETE /api/v1/folders/ calls, correlating the caller's user identifier with folder ownership metadata in the database.
Alert when the ratio of folder deletions by non-owners exceeds a baseline threshold across any 24-hour window.
Review database change history for bulk removals from the chat and folder tables attributable to non-owner sessions.

Monitoring Recommendations

Forward Open WebUI application logs and reverse proxy access logs to a central log platform for retention and query.
Track authentication events for accounts holding write access to shared folders and flag deletion activity from those sessions.
Monitor the /api/v1/folders/ route for anomalous request rates or repeated 200 responses to non-owner delete calls.

How to Mitigate CVE-2026-70494

Immediate Actions Required

Upgrade Open WebUI to version 0.11.0 or later, which contains the fix from pull request #27003.
Audit shared folder collaborator lists and revoke write access for accounts that do not require it.
Back up the Open WebUI database before upgrading so any deletions that occurred prior to remediation can be recovered.

Patch Information

The fix is committed in 915ef7d0 and shipped in the Open WebUI v0.11.0 release. The maintainers documented the issue in GHSA-3cg5-48j3-v4gv. The patch enforces that only the folder owner or a user with the admin role can delete a folder and cascade its contents.

Workarounds

Downgrade shared folder collaborators from write to read-only access until the upgrade to 0.11.0 is complete.
Restrict network access to the Open WebUI API to trusted users while the platform runs an affected version.
Disable folder sharing features in deployments where collaboration is not required.

bash

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:v0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.0