CVE-2026-29070: 
Python vulnerability analysis and mitigation

CVE-2026-29070 is a missing authorization vulnerability in Open WebUI, a self-hosted AI platform, that allows authenticated users to delete arbitrary files from any knowledge base without owning or having access to it. The flaw affects all versions prior to 0.8.6 and was disclosed on March 26, 2026, by researcher ScaumAcktiv via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 5.4 (Moderate) per the official advisory, though Feedly's aggregated data notes an alternate score of 8.1 based on a different vector assessment (Github Advisory, Open WebUI Advisory).

The root cause is CWE-862 (Missing Authorization) in the remove_file_from_knowledge_by_id endpoint located in backend/open_webui/routers/knowledge.py (line ~L803). The endpoint validates that the requesting user has write access to the specified knowledge base, but performs no check to confirm that the target file_id actually belongs to that knowledge base. As a result, any authenticated user with write access to at least one knowledge base can supply an arbitrary file_id in the POST body to delete files from any other knowledge base on the platform. The only precondition is that the attacker knows (or can enumerate) the UUID of the target file (Open WebUI Advisory, Github Advisory).

Successful exploitation allows an authenticated attacker to permanently delete files — including their vector database collections — from any knowledge base on the Open WebUI instance, regardless of access permissions. This results in high integrity and availability impact to affected knowledge bases, as curated AI knowledge data can be irreversibly destroyed. There is no confidentiality impact, as the vulnerability enables deletion only, not data exfiltration. In multi-tenant or enterprise deployments, a low-privileged user could systematically destroy knowledge bases belonging to other users or teams (Open WebUI Advisory, Github Advisory).

A proof-of-concept exploit is publicly documented in the official security advisory, demonstrating the attack with a concrete HTTP POST request. The EPSS score is approximately 0.051% (16th percentile), indicating low near-term exploitation probability. There is no evidence of in-the-wild exploitation at this time, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, Open WebUI Advisory).

1. Authenticate: Obtain a valid user account on the target Open WebUI instance with write access to at least one knowledge base. Retrieve a Bearer token via the login API.
2. Create or identify an attacker-controlled knowledge base: Note the UUID of a knowledge base the attacker owns or has write access to (e.g., dde9e2b6-21c9-4aa1-a1cf-8cb0e4392f2b).
3. Enumerate target file IDs: Identify the UUID of a file belonging to a victim's knowledge base. This may be obtained through API enumeration, social engineering, or other information disclosure.
4. Send the malicious deletion request: Issue a POST request to the attacker's own knowledge base endpoint, supplying the victim's file ID in the body:

POST /api/v1/knowledge/dde9e2b6-21c9-4aa1-a1cf-8cb0e4392f2b/file/remove HTTP/1.1
Host: <target>
Authorization: Bearer <token>
Content-Type: application/json

{"file_id":"9db6dcee-bb3b-483e-aaf3-310fda366af1"}

5. Confirm deletion: The server responds with HTTP 200 OK, and the victim's file is permanently deleted from their knowledge base and the vector database (Open WebUI Advisory).

• Network: Unexpected POST requests to /api/v1/knowledge/<id>/file/remove where the knowledge base <id> does not match the knowledge base that owns the specified file_id; repeated deletion requests from a single user account targeting multiple different file IDs.
• Logs: Application logs showing Files.delete_file_by_id calls for file IDs not associated with the knowledge base ID in the request path; HTTP 200 responses to /file/remove endpoints from users who do not own the affected knowledge base.
• File System / Database: Unexpected disappearance of files from knowledge bases without corresponding user activity in those bases; missing vector database collections prefixed with file-<uuid> that were not explicitly removed by the knowledge base owner (Open WebUI Advisory).

Upgrade Open WebUI to version 0.8.6 or later, which patches the missing authorization check by validating that the file being deleted belongs to the specified knowledge base. As a temporary workaround if immediate upgrade is not possible, restrict knowledge base write access to only fully trusted users, since any user with write access to any knowledge base can exploit this flaw. There is no configuration-only mitigation that fully prevents exploitation without upgrading (Github Advisory, Open WebUI Advisory).