CVE-2026-59217: open-webui Missing Authorization

Vulnerability summary

CVE-2026-59217 is a medium (CVSS 4.3) Missing Authorization vulnerability in open-webui. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-07-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledge_id and auto-linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing read-only knowledge-base users to add arbitrary files. This issue is fixed in version 0.10.0.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.