CVE-2026-28788: high-severity vulnerability in open-webui
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Open WebUI allows any logged-in user to overwrite files they should only be able to read, by guessing or discovering file IDs. An attacker can change file contents to trick the AI into giving false information to other users.
The `POST /api/v1/retrieval/process/files/batch` endpoint lacks authorization checks on file ownership, permitting authenticated users to modify arbitrary files via their UUIDs. An attacker can enumerate file IDs through `GET /api/v1/knowledge/{id}/files` and overwrite content served to the LLM via RAG, achieving privilege escalation from read to write access and information manipulation.
In the same product, most dangerous first.