CVE-2026-109284

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109284
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109284.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109284
Aliases
  • GHSA-6fjc-5cg3-mgvh
Published
2026-10-12T16:04:46Z
Modified
2026-10-13T02:45:48Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint
Details

Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109284.json"
}
References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type
GIT
Repo
https://github.com/open-webui/open-webui
Events
Introduced
f9590b8017199e56d5e953657e6498e3cef1d246
Fixed
8bd8b4fac5e059578ac0c74b3c18d11139f88b7d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.11.0"
        },
        {
            "fixed":  "0.11.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.11.0
v0.11.1
v0.11.2
v0.11.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109284.json"