The flaw lies in the POST /api/v1/retrieval/process/web endpoint, which lacks an authorization check on the supplied collection_name and overwrite flag. When overwrite=True, the application deletes the target collection before writing new data, allowing an attacker to delete or overwrite any collection. This leads to loss of stored knowledge and potential manipulation of Retrieval Augmented Generation content, compromising both integrity and availability. The weakness is classified as CWE‑862, Unauthorized Access.

The affected product is open‑webui. All publicly available versions prior to 0.9.0 are vulnerable. The patch was applied in release 0.9.0, so any deployment running an earlier version must be updated.

The CVSS score of 8.1 reflects a high severity, and the EPSS score is not available, so the realistic exploitation probability is unclear. The vulnerability is not yet listed in CISA’s KEV catalog. Based on the description, it is inferred that the threat vector is remote, over HTTP/HTTPS, and that an attacker does not require prior authentication to exploit the endpoint, enabling broad potential impact.