AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-26g9-27vm-x3q8: Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

highvulnerability

security

Source: GitHub Advisory DatabaseMay 14, 2026CVE-2026-45671

Summary

Any authenticated user can permanently delete files owned by other users in Open WebUI when those files are referenced in shared chats, because the authorization check (the code that verifies whether a user should be allowed to perform an action) ignores both the user's identity and the type of operation being requested. File IDs can be discovered by users with read access to knowledge bases (repositories of documents), making this vulnerability practical to exploit.

Solution / Mitigation

Gate the shared-chat branch on `access_type` so it only authorizes read operations: `if access_type == "read": chats = Chats.get_shared_chats_by_file_id(file_id, db=db) if chats: return True`. This ensures that only read requests pass the authorization check when a file is in a shared chat, while delete and write requests are blocked.