CVE-2026-87998

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87998
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87998.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87998
Aliases
Published
2026-09-09T21:31:48Z
Modified
2026-09-12T03:30:47Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L CVSS Calculator
Summary
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Details

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable. This issue is fixed in version 0.11.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-269",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87998.json"
}
References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type
GIT
Repo
https://github.com/open-webui/open-webui
Events
Introduced
4d2e13cf2bcc451b33bb6374bea4d2163e6cc94c
Fixed
dc03e7e595d61be97b25a1dd7bb99ad264f73199
Fixed
d3e8bf3405e848cfba377814d0aa7ba7290e414d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.10.0"
        },
        {
            "fixed": "0.11.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.11.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87998.json"