Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-09T22:18:48.460Z",
  "pubdate": "2026-09-09T22:18:48.460Z",
  "executiveSummary": "Open WebUI versions 0.10.0 through 0.11.1 contain an improper authorization vulnerability within the knowledge base management system. This flaw allows a non-administrative user with write access to a single knowledge base to trigger a global deletion of shared external configurations.\nThe vulnerability resides in the backend/open_webui/routers/knowledge.py file, specifically within the DELETE /api/v1/knowledge/{id}/delete endpoint. While the endpoint performs initial authorization to verify ownership of a specific knowledge base, it lacks a subsequent verification step to determine if the associated external connection is administrator-owned or shared among other knowledge bases.\nThe risk implication is significant, as a low-privileged attacker can disrupt the availability of every knowledge base dependent on a shared external connection, effectively resulting in a denial-of-service (DoS) for global knowledge management capabilities.\nExploitation requires authenticated access with write permissions to at least one knowledge base. No complex prerequisites are necessary, as the logic error occurs server-side during the execution of the deletion request.\nUsers are urged to upgrade to version 0.11.1 or later to remediate the flaw, which includes the necessary authorization checks to prevent unauthorized modification or removal of shared administrative resources.",
  "technicalDetails": "The vulnerability exists in the implementation of the knowledge base deletion logic within backend/open_webui/routers/knowledge.py. The application provides an interface for users to manage external knowledge bases; however, the API endpoint DELETE /api/v1/knowledge/{id}/delete fails to correctly validate the scope of the user's authority when handling the associated external connection objects.\nThe root cause is a deficiency in the authorization workflow. When a user requests the deletion of a knowledge base, the application correctly checks if the user possesses write access to the target object. However, the subsequent routine responsible for purging the associated external connection does not implement a check to verify if the connection is exclusive to the user or if it is an administrator-owned resource shared globally by other knowledge bases.\nAttack flow: 1. An authenticated attacker with write access to a personal or non-restricted knowledge base initiates a DELETE request to /api/v1/knowledge/{id}/delete. 2. The backend confirms the user has permissions to act on the target {id}. 3. The application proceeds to execute the cleanup of the external connection linked to this knowledge base. 4. Because the code fails to validate the scope of the external connection, it executes a removal command on the shared administrative configuration. 5. Any other knowledge bases relying on this shared connection are immediately orphaned or rendered inaccessible, leading to a state of service degradation for other platform users.\nThis vulnerability is classified as an improper authorization flaw because the system treats the scope of the deletion command too broadly. It assumes that because the user owns the knowledge base, they are authorized to destroy the underlying connection infrastructure, even if that infrastructure serves higher-level administrative entities.\nImpact: Successful exploitation results in the unauthorized removal of global configuration data. By targeting a shared connection, an attacker can force a cascading failure across the platform, disrupting the retrieval-augmented generation (RAG) capabilities for any users or knowledge bases associated with that specific connection. The vulnerability affects all deployments within the version range 0.10.0 to 0.11.1. No administrative privilege is required to initiate the delete sequence, provided the attacker has write access to at least one knowledge entry."
}