Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| open-webui | open-webui | unaffected |
|
No data.
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 12 Oct 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members. | |
| Title | Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint | |
| First Time appeared |
Openwebui
Openwebui open Webui |
|
| Weaknesses | CWE-862 | |
| CPEs | cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Openwebui
Openwebui open Webui |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-12T16:04:46.613Z
Reserved: 2026-10-12T14:12:03.637Z
Link: CVE-2026-109284
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-12T17:17:21.317
Modified: 2026-10-12T17:17:21.317
Link: CVE-2026-109284
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-862
Missing Authorization