CVE-2026-87998

Open WebUI versions 0.10.0 through versions before 0.11.1 mishandle authorization on the knowledge-base deletion endpoint (DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py): after authorizing the deletion of a knowledge base, the handler also removes the administrator-owned external connection behind it without performing a separate administrator check or checking whether other knowledge bases depend on that connection. A non-administrator user who has write access to a single external knowledge base can trigger this by issuing a deletion request to the API route. The attacker gains the ability to delete shared instance configuration, making every other knowledge base that uses the same connection unavailable, an integrity and availability impact reflected in the CVSS 7.1 score (C:N/I:H/A:L) with no confidentiality loss. Affected users are operators of self-hosted Open WebUI instances running the affected range, especially multi-user deployments that share administrator-managed external connections. The issue is fixed in version 0.11.1; there is no public proof-of-concept, no known in-the-wild exploitation, and the flaw is not in CISA's KEV catalog.

What to do: Upgrade Open WebUI to version 0.11.1 or later. As interim mitigation, limit write access on knowledge bases backed by administrator-managed external connections to administrators only, and review access logs for DELETE requests to /api/v1/knowledge/{id}/delete issued by non-admin accounts; if such requests occurred, verify that shared external connections and dependent knowledge bases are intact.