CVE-2026-87997: Open WebUI Authentication Bypass Vulnerability

CVE-2026-87997 Overview

CVE-2026-87997 is a broken access control vulnerability [CWE-639] in Open WebUI, an extensible self-hosted AI platform. Versions from 0.10.0 up to (but not including) 0.11.1 fail to enforce folder write-access checks in two chat completion endpoints. The POST /api/chat/completions and POST /api/v1/chat/completions routes in backend/open_webui/main.py copy a client-supplied folder_id into a newly created chat without validating the caller's permissions on that folder. An authenticated user who knows a shared folder identifier can inject attacker-controlled chats into folders where they have read-only or no write access. The issue is fixed in version 0.11.1.

Critical Impact
Authenticated users can plant unauthorized chat entries into shared folders, causing malicious or misleading content to appear to legitimate folder readers.

Affected Products

Open WebUI 0.10.0 through 0.11.0
Open WebUI self-hosted AI platform deployments exposing chat completion APIs
Multi-tenant Open WebUI instances using shared folders for chat organization

Discovery Timeline

2026-09-09 - CVE-2026-87997 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87997

Vulnerability Analysis

The vulnerability stems from inconsistent authorization enforcement across chat-creation code paths in Open WebUI. Dedicated chat routes in backend/open_webui/routers/chats.py correctly validate folder access before assigning a chat to a folder. The chat completion endpoints in backend/open_webui/main.py skipped this check entirely. When a request body included a folder_id field, the value was persisted directly onto the new chat record. This allowed any authenticated user with a valid folder identifier to bypass the folder ownership boundary. The result is an authorization gap where read-only folder members can effectively write into folders they cannot legitimately modify.

Root Cause

The root cause is a missing authorization check classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The chat completion handlers accepted the client-supplied folder_id as trusted input. No call to has_folder_write_access guarded the assignment. The dedicated folder routes implemented this check, but the logic was not shared across all chat-creation entry points.

Attack Vector

Exploitation requires network access to the Open WebUI API and valid authentication credentials. The attacker must know or discover a shared folder_id value. The attacker then issues a POST request to /api/chat/completions or /api/v1/chat/completions with the target folder identifier embedded in the request body. The server creates the chat and assigns it to the targeted folder without verifying write permission. Other users who legitimately view that folder will see the injected chat as authentic content.

python

# Security patch: backend/open_webui/main.py
# Adds the shared folder write-access helper import
 from open_webui.utils import logger
 from open_webui.utils.access_control import has_permission
+from open_webui.utils.access_control.folders import has_folder_write_access
 from open_webui.utils.actions import chat_action as chat_action_handler
 from open_webui.utils.asgi_middleware import (
     AuthTokenMiddleware,

# Security patch: backend/open_webui/routers/chats.py
# Consolidates access checks into a single helper module
-from open_webui.utils.access_control.folders import has_folder_access
+from open_webui.utils.access_control.folders import has_folder_access, has_folder_write_access

Source: GitHub Commit d9e23b90

Detection Methods for CVE-2026-87997

Indicators of Compromise

Chat records with folder_id values referencing folders the chat owner does not own or have write access to
Unexpected chats appearing in shared folders reported by folder owners or readers
POST requests to /api/chat/completions or /api/v1/chat/completions containing folder_id fields from users without folder write permissions

Detection Strategies

Audit the chat database for entries where the chat creator's user ID lacks a corresponding write grant on the associated folder_id
Correlate application logs of chat completion API calls with folder membership tables to identify authorization mismatches
Review API access logs for anomalous folder identifiers being submitted by low-privilege accounts

Monitoring Recommendations

Enable request-body logging on the chat completion endpoints and alert on folder_id usage by non-owner accounts
Track creation timestamps of chats in shared folders and flag entries created outside expected user workflows
Monitor Open WebUI application logs for repeated POST requests referencing the same shared folder_id from multiple user contexts

How to Mitigate CVE-2026-87997

Immediate Actions Required

Upgrade all Open WebUI deployments to version 0.11.1 or later without delay
Inventory shared folders and review recently created chats for unauthorized entries
Rotate or revoke shared folder identifiers that may have been exposed to untrusted authenticated users

Patch Information

Open WebUI version 0.11.1 resolves the vulnerability by importing has_folder_write_access into backend/open_webui/main.py and applying the shared folder write-access check across all chat creation paths. See the GitHub Security Advisory GHSA-3pf7-q2g3-wj28, GitHub Pull Request 28366, and the GitHub Release v0.11.1 for full remediation details.

Workarounds

Restrict network access to the Open WebUI API to trusted user populations until patching completes
Temporarily disable use of shared folders in multi-tenant deployments where feasible
Apply a reverse-proxy filter that strips the folder_id field from POST bodies sent to /api/chat/completions and /api/v1/chat/completions

bash

# Example: upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.11.1