Open WebUI allows an authenticated user to specify a folder_id when creating a chat through POST /api/chat/completions. The backend copies the supplied folder_id into the new chat record without enforcing the write‑access check that normal chat routes apply. As a result, an attacker who knows the identifier of a shared folder can inject a chat into that folder even if the user has only read access. The injected chat becomes visible to anyone with read permission on the folder, effectively allowing data insertion into another user’s workspace without authorization. This is a privilege escalation at the authorization layer, corresponding to CWE‑639 and CWE‑862.

Affected vendor: Open WebUI (open-webui:open-webui). Affected versions: 0.10.0 through 0.11.1 inclusive. The issue is fixed in 0.11.1.

The vulnerability has a CVSS score of 4.3, indicating low severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. The attack vector is likely via the web API, requiring an authenticated user who knows a valid shared folder identifier. Successful exploitation permits insertion of data into another user’s folder, causing that content to appear to readers of the folder who otherwise would not have permission to create or view it.