Improper Authorization Vulnerability in Open WebUI by Open WebUI

CVE-2026-109284

What is CVE-2026-109284?

An improper authorization vulnerability exists in Open WebUI versions 0.11.0 through 0.11.3, specifically in the chat fork handler. This flaw allows users with downgraded permissions to post forked chats in folders where they previously held write access. As a result, these unauthorized users can insert malicious or attacker-controlled chats into the folders of legitimate folder owners, compromising the integrity of shared chats and potentially leading to unauthorized access and information leakage.

References