CVE-2026-109284
Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.
| CWE | CWE-862 |
| Vendor | open-webui |
| Product | open-webui |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for open-webui open-webui
Be the first to know when new medium vulnerabilities affecting open-webui open-webui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
open-webui / open-webui
0.11.0 < 0.11.4
References
Credits
🔍 avrlab233 Classic298