CVE-2026-109284: Open WebUI: chat fork lacks folder write check

MEDIUM

Published October 12, 2026

CISO Take

Open WebUI 0.11.0 through 0.11.3 has a missing authorization check (CWE-862) in its chat fork endpoint. A user who has been downgraded from write to read-only on a shared folder can still call POST /api/v1/chats/{id}/fork on chats they created there, and the forked chat is inserted into the folder where the owner and other members see it. The impact is low (CVSS 4.3, integrity only, no confidentiality or availability loss), with no KEV listing, no public exploit, no Nuclei template, and no EPSS score yet, so active exploitation is not indicated. The package has only 3 downstream dependents, but Open WebUI is commonly deployed as a shared internal LLM front end, and it has 186 other CVEs on record, which points to a recurring access-control weakness. Upgrade to 0.11.4 or later, and in the meantime review shared folders for chats created by users whose access was reduced.

Sources:NVDGitHub AdvisoryVulnCheckATLASOpenSSF

What is the risk?

Low to medium risk. Exploitation is network-reachable, low complexity, needs only a low-privilege authenticated account, and requires no user interaction. The attacker must be a former write-access member of a shared folder who owns a chat there, which limits the pool of attackers to insiders or recently demoted collaborators. Impact is limited to integrity: unauthorized content inserted into a folder. No confidentiality or availability impact. Exploitation likelihood is low-to-moderate given the simple request, but no exploit tooling or in-the-wild activity is known. Overall priority is routine patching, higher for teams that use shared folders to distribute prompts, knowledge or operating guidance.

How does the attack unfold?

Initial Access

An authenticated user who was demoted to read-only on a shared folder still holds their own chat there.

AML.T0012

Exploitation

The user calls POST /api/v1/chats/{id}/fork and the handler skips the folder write-access check.

AML.T0049

Impact

A forked chat with attacker-controlled content appears in the shared folder for the owner and members, who may trust or reuse it.

AML.T0080.001

Initial Access

An authenticated user who was demoted to read-only on a shared folder still holds their own chat there.

AML.T0012

Exploitation

The user calls POST /api/v1/chats/{id}/fork and the handler skips the folder write-access check.

AML.T0049

Impact

A forked chat with attacker-controlled content appears in the shared folder for the owner and members, who may trust or reuse it.

AML.T0080.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

ILow

ANone

What should I do?

1 step

1) Upgrade open-webui to 0.11.4 or later (see GHSA-6fjc-5cg3-mgvh). 2) Until patched, avoid downgrading members to read-only in shared folders where untrusted users have had write access, or remove them from the folder entirely instead of demoting. 3) Audit shared folders for chats created or forked after a user's permissions were reduced, comparing fork timestamps with permission-change records. 4) Monitor reverse proxy and application logs for POST /api/v1/chats/*/fork requests from users who hold read-only folder access. 5) Review user roles and folder membership periodically, and tell folder owners to treat unexpected chats as untrusted.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassFrameworkAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0080.001- Thread

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.9.2-Processes for responsible use of AI systems

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede deployed AI systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-109284?

Is CVE-2026-109284 actively exploited?

No confirmed active exploitation of CVE-2026-109284 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109284?

1) Upgrade open-webui to 0.11.4 or later (see GHSA-6fjc-5cg3-mgvh). 2) Until patched, avoid downgrading members to read-only in shared folders where untrusted users have had write access, or remove them from the folder entirely instead of demoting. 3) Audit shared folders for chats created or forked after a user's permissions were reduced, comparing fork timestamps with permission-change records. 4) Monitor reverse proxy and application logs for POST /api/v1/chats/*/fork requests from users who hold read-only folder access. 5) Review user roles and folder membership periodically, and tell folder owners to treat unexpected chats as untrusted.

What systems are affected by CVE-2026-109284?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Self-hosted LLM gateways, Multi-user collaborative AI workspaces.

What is the CVSS score for CVE-2026-109284?

CVE-2026-109284 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsSelf-hosted LLM gatewaysMulti-user collaborative AI workspaces

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0080.001Thread

Compliance Controls Affected

ISO 42001: A.9.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.

Exploitation Scenario

A contractor is given write access to a shared team folder in an internal Open WebUI instance and creates a chat there. When the engagement ends, an admin demotes the contractor to read-only rather than removing them. The contractor authenticates and sends POST /api/v1/chats/{id}/fork for their own chat. The server places the fork in the shared folder without checking write access. The forked chat contains crafted instructions and misleading guidance, for example a fake runbook or prompt template. Team members who open the folder see it as ordinary content and may follow it or reuse the prompt in their workflows.

Weaknesses (CWE)

CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.