GHSA-26g9-27vm-x3q8: Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

Summary

Any authenticated Open WebUI user can permanently delete files owned by other users through DELETE /api/v1/files/{id} when the file is referenced in any shared chat. The has_access_to_file() function in backend/open_webui/routers/files.py grants access through its shared-chat branch without checking the requesting user's identity or the access_type operation. File UUIDs are exposed to users with read access to a knowledge base via GET /api/v1/knowledge/{id}/files, and the flaw was tested on version 0.8.3.

Mitigation

Suggested fix: gate the shared-chat branch on access_type so it only authorizes read operations, by checking if access_type == "read" before returning True when shared chats reference the file.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database