Open WebUI allows users with write access to a knowledge base to delete files from any knowledge base if the file identifier is known. The system only checks that the user is authorized to write to the target knowledge base; it does not confirm that the file actually belongs to that base. This missing authorization check (CWE-862) enables arbitrary file removal, which can compromise data integrity and disrupt operations. The vulnerability is present in all releases prior to version 0.8.6 and is fixed in that release.

The affected product is Open WebUI, a self‑hosted artificial intelligence platform identified as open‑webui:open‑webui. All versions older than 0.8.6 are impacted; version 0.8.6 and later contain a patch that enforces proper ownership checks for file deletion.

The CVSS score of 5.4 indicates moderate severity, while an EPSS score below 1% suggests that automated exploitation is unlikely. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have authenticated write permission on at least one knowledge base and knowledge of the target file’s identifier; no public remote execution is possible. Nonetheless, an insider with low privileges could cause data loss or business disruption by deleting critical files from other knowledge bases.