CVE-2026-87997: Open WebUI folder auth bypass

Q: Is CVE-2026-87997 actively exploited?

No confirmed active exploitation of CVE-2026-87997 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-87997?

1) Upgrade Open WebUI to version 0.11.1 or later immediately — this is the only complete fix, since the flaw is a missing server-side authorization check. 2) Until patched, restrict or disable folder-sharing features for users who should not have cross-user visibility, and avoid exposing folder identifiers in shareable links. 3) Audit `chat` and `folder` tables (or equivalent admin UI) for chat entries created by users without corresponding folder write permissions, as a compromise indicator. 4) Review access logs for anomalous POST requests to `/api/chat/completions` or `/api/v1/chat/completions` carrying `folder_id` values not owned by the requesting user. 5) Apply least-privilege folder sharing going forward — only share folders with users who genuinely need write access.

Q: What systems are affected by CVE-2026-87997?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, team/shared LLM chat interfaces.

Q: What is the CVSS score for CVE-2026-87997?

CVE-2026-87997 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.22%.

CISO Take

Open WebUI, a self-hosted AI chat platform, failed to apply its folder write-access check to two chat-completion endpoints, letting any authenticated user who knows a shared folder identifier inject an attacker-controlled chat entry into a folder where they only have read access or none at all. The blast radius is contained to the 3 tracked downstream dependents of open-webui, and with no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template, this is not being mass-exploited today — but the package already carries 168 other CVEs and a package risk score of 38/100, signaling ongoing security debt worth tracking. The real risk is trust and integrity, not confidentiality or availability (CVSS 4.3, C:N/I:L/A:N): a low-privilege insider or compromised account can plant content — including social-engineering lures or crafted prompts — into a shared workspace that other users assume is curated and authorized. Patch to open-webui 0.11.1 immediately; this is a straightforward server-side authorization fix with no reliable compensating control short of restricting or disabling folder sharing. Audit shared-folder membership and recent chat entries for unexplained additions as a detection measure until every instance is patched.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity (CVSS 4.3, AV:N/AC:L/PR:L/UI:N). Exploitation requires only a low-privileged authenticated account and knowledge of a folder identifier — no user interaction, low complexity — making it easy to execute once an attacker has any account on the instance. However, impact is scoped to integrity only (I:L): the attacker cannot read or modify existing content, exfiltrate data, or disrupt availability, only inject a new chat entry into a folder they shouldn't be able to write to. No EPSS score, no CISA KEV listing, no public PoC, and no Nuclei template exist, so near-term mass exploitation is unlikely. Risk rises for multi-tenant or team-shared Open WebUI deployments (common in enterprise self-hosted AI rollouts) where folder identifiers may be predictable, logged in URLs, or shared broadly across an organization.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privileged authenticated account on the Open WebUI instance.

AML.T0012

Target Discovery

Attacker learns the identifier of a shared folder they can read but not write to, via a shared link, UI inspection, or prior exposure.

Exploitation

Attacker sends a crafted POST to /api/chat/completions or /api/v1/chat/completions with the target folder_id; the missing write-access check lets the request succeed.

AML.T0049

Impact

An attacker-controlled chat entry appears in the folder to all authorized readers, enabling misinformation, embedded phishing links, or fabricated evidence to be trusted as legitimate content.

Initial Access

Attacker obtains or already holds a low-privileged authenticated account on the Open WebUI instance.

AML.T0012

Target Discovery

Attacker learns the identifier of a shared folder they can read but not write to, via a shared link, UI inspection, or prior exposure.

Exploitation

Attacker sends a crafted POST to /api/chat/completions or /api/v1/chat/completions with the target folder_id; the missing write-access check lets the request succeed.

AML.T0049

Impact

An attacker-controlled chat entry appears in the folder to all authorized readers, enabling misinformation, embedded phishing links, or fabricated evidence to be trusted as legitimate content.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.10.0, < 0.11.1	`0.11.1`
151.8K 3 dependents Pushed 7d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

1) Upgrade Open WebUI to version 0.11.1 or later immediately — this is the only complete fix, since the flaw is a missing server-side authorization check. 2) Until patched, restrict or disable folder-sharing features for users who should not have cross-user visibility, and avoid exposing folder identifiers in shareable links. 3) Audit chat and folder tables (or equivalent admin UI) for chat entries created by users without corresponding folder write permissions, as a compromise indicator. 4) Review access logs for anomalous POST requests to /api/chat/completions or /api/v1/chat/completions carrying folder_id values not owned by the requesting user. 5) Apply least-privilege folder sharing going forward — only share folders with users who genuinely need write access.

How is it classified?

Auth Bypass Framework API AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2 - AI system security controls / access control

Frequently Asked Questions

What is CVE-2026-87997?

Open WebUI, a self-hosted AI chat platform, failed to apply its folder write-access check to two chat-completion endpoints, letting any authenticated user who knows a shared folder identifier inject an attacker-controlled chat entry into a folder where they only have read access or none at all. The blast radius is contained to the 3 tracked downstream dependents of open-webui, and with no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template, this is not being mass-exploited today — but the package already carries 168 other CVEs and a package risk score of 38/100, signaling ongoing security debt worth tracking. The real risk is trust and integrity, not confidentiality or availability (CVSS 4.3, C:N/I:L/A:N): a low-privilege insider or compromised account can plant content — including social-engineering lures or crafted prompts — into a shared workspace that other users assume is curated and authorized. Patch to open-webui 0.11.1 immediately; this is a straightforward server-side authorization fix with no reliable compensating control short of restricting or disabling folder sharing. Audit shared-folder membership and recent chat entries for unexplained additions as a detection measure until every instance is patched.

Is CVE-2026-87997 actively exploited?

No confirmed active exploitation of CVE-2026-87997 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87997?

1) Upgrade Open WebUI to version 0.11.1 or later immediately — this is the only complete fix, since the flaw is a missing server-side authorization check. 2) Until patched, restrict or disable folder-sharing features for users who should not have cross-user visibility, and avoid exposing folder identifiers in shareable links. 3) Audit `chat` and `folder` tables (or equivalent admin UI) for chat entries created by users without corresponding folder write permissions, as a compromise indicator. 4) Review access logs for anomalous POST requests to `/api/chat/completions` or `/api/v1/chat/completions` carrying `folder_id` values not owned by the requesting user. 5) Apply least-privilege folder sharing going forward — only share folders with users who genuinely need write access.

What systems are affected by CVE-2026-87997?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, team/shared LLM chat interfaces.

What is the CVSS score for CVE-2026-87997?

CVE-2026-87997 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

agent frameworksteam/shared LLM chat interfaces

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1.

Exploitation Scenario

An organization deploys Open WebUI as a shared internal AI assistant, with a folder used by the security team to collect vetted, reviewed chat transcripts for compliance evidence. A low-privileged employee (or a compromised low-privilege account) with only read access to that folder learns its folder_id — perhaps from a shared link, browser history, or by observing UI traffic — and sends a crafted POST request to `/api/chat/completions` including that folder_id. The missing write-access check lets the request succeed, silently inserting an attacker-controlled chat entry into the security team's folder. When the security team later reviews the folder as part of an audit or compliance evidence pack, they unknowingly treat the planted chat as legitimate, potentially acting on fabricated information, clicking an embedded malicious link, or citing it in a compliance report.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-862 Missing Authorization Primary CWE-639 Authorization Bypass Through User-Controlled Key CWE-862 Missing Authorization

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.