CVE-2026-87997

Low

No strong exploitation signal.

CVSS base

4.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS — probability of exploitation (30 days)

0.2%

12.4th percentile

CISA KEV

Not listed

Weakness / dates

CWE-639

Published 2026-09-09 · modified 2026-09-16

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	N	None
Integrity	L	Low
Availability	N	None

Timeline

2026-09-09 — Published (NVD)
2026-09-16 — Last modified (NVD)

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1.

Affected

openwebui

References

Official: NVD · CVE.org