CVE-2026-87998: Open WebUI Privilege Escalation Vulnerability

CVE-2026-87998 Overview

CVE-2026-87998 is an improper privilege management vulnerability [CWE-269] in Open WebUI, a self-hosted AI platform. The flaw exists in the DELETE /api/v1/knowledge/{id}/delete endpoint located in backend/open_webui/routers/knowledge.py. Affected versions from 0.10.0 through 0.11.0 authorize deletion at the knowledge base level, then remove the administrator-owned external connection without a separate administrator check. A non-administrator with write access to a single external knowledge base can delete a shared instance configuration. This action makes every other knowledge base relying on that connection unavailable. The issue is fixed in version 0.11.1.

Critical Impact
A low-privileged authenticated user can disrupt integrity and availability of shared knowledge base connections across the entire Open WebUI deployment.

Affected Products

Open WebUI versions 0.10.0 through 0.11.0
backend/open_webui/routers/knowledge.py router component
Fixed in Open WebUI version 0.11.1

Discovery Timeline

2026-09-09 - CVE-2026-87998 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87998

Vulnerability Analysis

Open WebUI supports external knowledge base connections that are owned by administrators and shared across multiple knowledge bases. The deletion handler in knowledge.py validated whether the requesting user held write access on the target knowledge base. It then proceeded to tear down the associated external connection object without re-checking privilege scope or dependency count. Because external connections are administrator-owned resources, this created a scope mismatch between the authorization check and the destructive action.

A user with write access to one external knowledge base could invoke the delete endpoint and remove the shared connection configuration. Every other knowledge base referencing that same connection becomes unreachable. The result is a horizontal-to-vertical privilege boundary crossing that impacts integrity of administrative configuration and availability of dependent resources.

Root Cause

The root cause is missing administrator authorization and missing dependency validation before removing shared external connections. The endpoint conflated two distinct authorization scopes: knowledge base access and administrative connection management.

Attack Vector

Exploitation requires network access and low-privileged authenticated credentials with write permissions on any external knowledge base. No user interaction is required. The attacker issues a standard authenticated DELETE request against the vulnerable endpoint.

python

     # Clean up vector DB
     if is_external_knowledge(knowledge):
         connection_id = (knowledge.meta or {}).get('external', {}).get('connection_id')
-        if connection_id:
+        # Connections are admin-owned and shared across knowledge bases
+        if (
+            connection_id
+            and user.role == 'admin'
+            and await _count_external_connection_mappings(connection_id, db=db) <= 1
+        ):
             connections = [
                 connection for connection in await _get_external_connections() if connection.get('id') != connection_id
             ]

Source: GitHub Commit dc03e7e

The patch adds two guards: the acting user must hold the admin role, and the connection must have at most one remaining mapping before removal.

Detection Methods for CVE-2026-87998

Indicators of Compromise

Unexpected DELETE /api/v1/knowledge/{id}/delete requests from non-administrator accounts in application logs
Sudden unavailability or errors across multiple knowledge bases that previously shared a common external connection
Missing entries in the external connections configuration store without a corresponding administrator action audit trail

Detection Strategies

Correlate Open WebUI application logs with user role metadata to flag DELETE calls from non-admin roles targeting external knowledge bases
Monitor for cascading knowledge base failures immediately following a single delete operation
Review external connection inventory changes and compare against the administrator action log

Monitoring Recommendations

Enable verbose audit logging for the knowledge.py router endpoints
Ship Open WebUI logs to a centralized logging platform for retention and correlation
Alert on any deletion of external connection objects outside a defined administrator maintenance window

How to Mitigate CVE-2026-87998

Immediate Actions Required

Upgrade Open WebUI to version 0.11.1 or later without delay
Audit existing user role assignments and revoke write access from accounts that do not require it
Review external knowledge base connection inventory to confirm no unauthorized deletions have occurred

Patch Information

The fix is delivered in Open WebUI version 0.11.1. Review the GitHub Security Advisory GHSA-2724-6cpj-gf3v, the GitHub Release v0.11.1 notes, and the Pull Request #28113 discussion for full technical context.

Workarounds

Restrict write access on external knowledge bases to administrators only until patching is complete
Place Open WebUI behind an authenticating reverse proxy that blocks the vulnerable DELETE endpoint for non-admin sessions
Back up external connection configurations so they can be restored quickly if deleted

bash

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:v0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.1