CVE-2026-87998
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable. This issue is fixed in version 0.11.1.
| CWE | CWE-269 CWE-863 |
| Vendor | open-webui |
| Product | open-webui |
| Published | Sep 9, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for open-webui open-webui
Be the first to know when new high vulnerabilities affecting open-webui open-webui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
open-webui / open-webui
>= 0.10.0, < 0.11.1
References
github.com: https://github.com/open-webui/open-webui/security/advisories/GHSA-2724-6cpj-gf3v github.com: https://github.com/open-webui/open-webui/pull/28113 github.com: https://github.com/open-webui/open-webui/commit/dc03e7e595d61be97b25a1dd7bb99ad264f73199 github.com: https://github.com/open-webui/open-webui/releases/tag/v0.11.1