Open WebUI’s file access verification function, _verify_knowledge_file_access, only checked for read permissions. Subsequent routes that handle file writing or deletion trusted access credentials derived from metadata entries. As a result, a user granted read‑only access to a model’s knowledge file could elevate that privilege to perform write or delete operations. This privilege escalation is a type of permission bypass, identified as CWE-863, and threatens the integrity of model data and the stability of the application.

The flaw affects the open-webui platform, versions 0.9.6 through any build before 0.10.0. No other vendors or products are listed as impacted. Deployments running any of those releases should assess whether they are exposed.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of < 1% shows a very low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. Attackers would need a valid user account that already has read‑only access to the knowledge file; they then exploit the web API to send write/delete requests. Because the vulnerability only affects authenticated users and not unauthenticated access, it is not a zero‑day attack but still allows a malicious actor to corrupt or delete essential model data.