CVE-2026-59212: Open WebUI IDOR lets read-only

Q: Is CVE-2026-59212 actively exploited?

No confirmed active exploitation of CVE-2026-59212 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-59212?

Upgrade to Open WebUI 0.10.0 or later immediately — the fix is in commit 17df0264929514599dbcb21c6578bcdfa204b04d and detailed in GHSA-2xwm-4h2q-ggfx. Until patched, avoid sharing knowledge collections with users who should only have read access, especially guests or lower-trust collaborators, and treat any read-shared knowledge base as effectively writable by those users. Audit application logs for file write/delete operations performed by accounts whose role/grant should be read-only, and review knowledge base version history or backups for unexpected modifications or deletions in shared collections.

Q: What systems are affected by CVE-2026-59212?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, knowledge base management, self-hosted AI platforms.

Q: What is the CVSS score for CVE-2026-59212?

CVE-2026-59212 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.33%.

CISO Take

Open WebUI's knowledge base access control only verified read permission before letting requests through, while the separate file write and delete routes trusted access flags embedded in a model's writable meta.knowledge entries instead of re-checking the user's actual permission level — so a user granted read-only access to a shared knowledge file could escalate to modifying or deleting it. This matters for any team running Open WebUI as a shared, multi-user RAG front end, since knowledge collections are the source data the AI assistant serves back to everyone with access. There's no evidence of active exploitation (not in CISA KEV, no EPSS score, no public exploit or Nuclei template), and the CVSS 5.4 (AC:L, PR:L, UI:N, but C:N/I:L/A:L) reflects a low-severity integrity/availability issue rather than data theft — but the authentication bar is low and no user interaction is needed, so any read-only collaborator can trivially trigger it. Upgrade to Open WebUI 0.10.0 or later now, and until patched, avoid granting read-only knowledge base access to untrusted or lower-trust users, monitoring for unexpected file writes/deletes performed by accounts that should only have read access.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity per CVSS (5.4) — authentication is required (PR:L) and impact is limited to integrity and availability of specific knowledge files (I:L/A:L), with no confidentiality impact (C:N). Attack complexity is low and requires no user interaction, so any authenticated account with even read-only access to a shared knowledge base can exploit it once they understand the object-derived access model. No KEV listing, no EPSS score, and no public exploit code or scanner template reduce the likelihood of opportunistic mass exploitation, but the bug is trivial to trigger for anyone who already holds a low-privilege account in a multi-tenant deployment (the most common real-world Open WebUI usage pattern).

How does the attack unfold?

Initial Access

Attacker holds or obtains a legitimate low-privilege account with read-only access to a shared Open WebUI knowledge collection.

AML.T0012

Discovery

Attacker identifies that file write/delete routes trust access derived from a model's writable meta.knowledge field instead of re-verifying the caller's actual permission level.

Exploitation

Attacker calls the write or delete file API referencing the read-only knowledge file, bypassing the intended read-only restriction (CWE-863).

Impact

Attacker modifies or deletes knowledge base documents, corrupting the RAG pipeline's source data served to other users of the AI assistant.

AML.T0059

Initial Access

Attacker holds or obtains a legitimate low-privilege account with read-only access to a shared Open WebUI knowledge collection.

AML.T0012

Discovery

Attacker identifies that file write/delete routes trust access derived from a model's writable meta.knowledge field instead of re-verifying the caller's actual permission level.

Exploitation

Attacker calls the write or delete file API referencing the read-only knowledge file, bypassing the intended read-only restriction (CWE-863).

Impact

Attacker modifies or deletes knowledge base documents, corrupting the RAG pipeline's source data served to other users of the AI assistant.

AML.T0059

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.9.6, < 0.10.0	`0.10.0`
149.6K 4 dependents Pushed yesterday 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A Low

What should I do?

1 step

Upgrade to Open WebUI 0.10.0 or later immediately — the fix is in commit 17df0264929514599dbcb21c6578bcdfa204b04d and detailed in GHSA-2xwm-4h2q-ggfx. Until patched, avoid sharing knowledge collections with users who should only have read access, especially guests or lower-trust collaborators, and treat any read-shared knowledge base as effectively writable by those users. Audit application logs for file write/delete operations performed by accounts whose role/grant should be read-only, and review knowledge base version history or backups for unexpected modifications or deletions in shared collections.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass RAG Framework AML.T0012 - Valid Accounts AML.T0059 - Erode Dataset Integrity AML.T0070 - RAG Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - Data for AI systems — access control

OWASP LLM Top 10

LLM08:2025 - Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-59212?

Open WebUI's knowledge base access control only verified read permission before letting requests through, while the separate file write and delete routes trusted access flags embedded in a model's writable meta.knowledge entries instead of re-checking the user's actual permission level — so a user granted read-only access to a shared knowledge file could escalate to modifying or deleting it. This matters for any team running Open WebUI as a shared, multi-user RAG front end, since knowledge collections are the source data the AI assistant serves back to everyone with access. There's no evidence of active exploitation (not in CISA KEV, no EPSS score, no public exploit or Nuclei template), and the CVSS 5.4 (AC:L, PR:L, UI:N, but C:N/I:L/A:L) reflects a low-severity integrity/availability issue rather than data theft — but the authentication bar is low and no user interaction is needed, so any read-only collaborator can trivially trigger it. Upgrade to Open WebUI 0.10.0 or later now, and until patched, avoid granting read-only knowledge base access to untrusted or lower-trust users, monitoring for unexpected file writes/deletes performed by accounts that should only have read access.

Is CVE-2026-59212 actively exploited?

No confirmed active exploitation of CVE-2026-59212 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59212?

Upgrade to Open WebUI 0.10.0 or later immediately — the fix is in commit 17df0264929514599dbcb21c6578bcdfa204b04d and detailed in GHSA-2xwm-4h2q-ggfx. Until patched, avoid sharing knowledge collections with users who should only have read access, especially guests or lower-trust collaborators, and treat any read-shared knowledge base as effectively writable by those users. Audit application logs for file write/delete operations performed by accounts whose role/grant should be read-only, and review knowledge base version history or backups for unexpected modifications or deletions in shared collections.

What systems are affected by CVE-2026-59212?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, knowledge base management, self-hosted AI platforms.

What is the CVSS score for CVE-2026-59212?

CVE-2026-59212 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesknowledge base managementself-hosted AI platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0059 Erode Dataset Integrity

AML.T0070 RAG Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_knowledge_file_access only checked read access while file write and delete routes later trusted object-derived access through writable model meta.knowledge entries, allowing a user with read-only knowledge file access to upgrade to file write or delete operations. This issue is fixed in version 0.10.0.

Exploitation Scenario

A contractor or guest user is granted read-only access to a shared knowledge collection in a multi-user Open WebUI deployment so they can query the team's RAG-powered assistant. Instead of only reading, they call the file write or delete API route directly, referencing the knowledge file via a model's `meta.knowledge` entry rather than through the normal read-checked path. Because that route trusts the object-derived access embedded in the model metadata instead of re-verifying the user's actual permission level, the request succeeds — the user can overwrite the file with misleading content or delete it outright, corrupting the source-of-truth documents that the AI assistant retrieves and surfaces to every other user of that knowledge base.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.