Listen to this Post
How CVE-2026-70494 Works
This vulnerability resides in Open WebUI’s folder sharing mechanism, specifically within the `DELETE /api/v1/folders/{id}` endpoint implemented in backend/open_webui/routers/folders.py. The core issue stems from an inconsistent authorization check that fails to enforce proper ownership verification for subfolder deletions.
When a user with write access to a shared folder attempts to delete it, the system performs an authorization check. For a root folder, the check correctly requires the user to be the folder’s owner or an administrator. However, for subfolders, the check erroneously accepts any inherited write grant, bypassing the ownership requirement.
The critical flaw is that the subsequent deletion cascade is tied to the folder owner’s ID, not the caller’s. Therefore, any user who passes the subfolder check—which only requires write access—can trigger the deletion of the owner’s entire chat history within that subfolder and all its descendants. Because write permissions on a root folder propagate to all its subfolders, an attacker with write access to a shared root folder can delete subfolders that were never explicitly shared with them.
Furthermore, if the `delete_contents` parameter is set to false, the same request does not delete the chats but instead force-moves them out of the folder, resulting in unauthorized data relocation. This vulnerability affects all Open WebUI releases from version 0.10.0 onward where folder sharing is enabled. The issue was fixed in version 0.11.0 by pull request 27003, which replaced the inconsistent checks with a single, unified requirement for ownership or admin status.
DailyCVE Form:
Platform: Open WebUI
Version: 0.10.0 to 0.11.0
Vulnerability: Improper Authorization
Severity: High (CVSS 8.1)
date: 2026-08-04
Prediction: 2026-08-04 (Fixed)
What Undercode Say:
The vulnerability’s root cause is a classic case of inconsistent authorization logic. The system’s access control check branches based on whether a folder has a parent. While root folders are protected, subfolders are left vulnerable, trusting any inherited write grant. This design flaw, combined with a deletion cascade that operates on the owner’s ID, creates a dangerous privilege escalation path. The fix correctly unifies the authorization logic, ensuring that ownership or admin status is required for all deletion operations, regardless of the folder’s position in the hierarchy.
The vulnerable endpoint
DELETE /api/v1/folders/{id}
Example request to delete a shared subfolder
curl -X DELETE "https://open-webui-instance.com/api/v1/folders/123" \
-H "Authorization: Bearer <attacker_token>" \
-H "Content-Type: application/json" \
-d '{"delete_contents": false}'
Exploit:
An attacker must have a valid user account and be granted write access to a shared chat folder by the victim. The `Folders Sharing` permission (user.permissions.sharing.folders) must be enabled (it is off by default). With these preconditions met, the attacker can simply send a `DELETE` request to the vulnerable endpoint targeting any subfolder within the shared folder’s tree. The system will authorize the request based on the inherited write grant and proceed to delete the owner’s data.
Protection:
The primary and complete mitigation is to upgrade Open WebUI to version 0.11.0 or later. This version contains the fix from pull request 27003, which corrects the authorization logic. No additional configuration changes are required after upgrading. For deployments that cannot upgrade immediately, disabling the `Folders Sharing` permission (user.permissions.sharing.folders) will prevent the vulnerability from being exploited, as it is a prerequisite for the attack.
Impact:
Successful exploitation leads to the permanent, irreversible destruction of another user’s chat history within and beneath the shared folder. The attacker can delete not only the shared folder’s contents but also any subfolders and their contents that were never explicitly shared. If the `delete_contents` parameter is set to false, the attack results in an unauthorized relocation of the owner’s chats. The impact is limited to the shared folder’s subtree, and no data outside of it is reachable or disclosed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
