CVE-2026-70488

Executive Summary

CVE-2026-70488 is an authorization bypass vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) in Open WebUI versions 0.9.6 through 0.11.0. The sync cleanup endpoint fails to validate that directory and file IDs supplied in the request body belong to the knowledge base specified in the URL, allowing a low-privileged user with write access to one knowledge base to delete directories and remove file embeddings from any other knowledge base. The vulnerability enables unauthorized data corruption and denial-of-service against RAG (Retrieval-Augmented Generation) infrastructure without exfiltrating or exposing document contents. The issue is rated Medium severity with a CVSS score of 4.3 and is fixed in version 0.11.0.

Technical Analysis

The vulnerability resides in the knowledge base sync cleanup mechanism of Open WebUI, a self-hosted AI platform that provides RAG capabilities for chat-with-file and document retrieval. The affected endpoint follows a RESTful pattern where the knowledge base identifier is encoded in the URL path, establishing an implicit authorization context. However, the request body contains an array of object references (directory IDs and file IDs) that the handler processes without cross-referencing them against the authorized knowledge base context.

From a code-level perspective, the flawed flow is:

1. Authentication: The requesting user is authenticated and authorized for the knowledge base ID in the URL path (e.g., /api/v1/knowledge/{kb_id}/sync/cleanup).
2. Authorization Check: The application verifies the user has write access to {kb_id}.
3. Parameter Extraction: The handler extracts directory_ids[] and file_ids[] from the JSON request body.
4. Vulnerable Operation: Without validating that each provided directory/file ID maps to a child object of {kb_id}, the handler directly issues DELETE operations against the underlying storage for each supplied ID.

The core flaw is the separation of authorization context from data identifiers. Traditional parameterized authorization requires that every user-controlled identifier be validated against the authenticated session's permitted scope. Here, the scope is derived solely from the URL, while the actual impact is driven by body parameters — a classic confused-deputy problem. An attacker can enumerate knowledge base IDs (which may be predictable UUIDs or discoverable via other endpoints if the instance does not enforce strict access control on listing operations) and then submit cleanup requests referencing victim knowledge base directory or file IDs.

The impact manifests as:

• Deletion of directories in a victim knowledge base, breaking its hierarchical structure.
• Removal of file embeddings from vector storage, causing documents to no longer appear in retrieval results.
• Breaking chat-with-file functionality, as the underlying document-to-embedding mappings are severed.

Importantly, the vulnerability does not allow content disclosure (CIA triad: Integrity and Availability affected, Confidentiality not), which is reflected in the CVSS vector C:N/I:L/A:N. The attack requires low privileges (PR:L), no user interaction, and is network-exploitable via the HTTP API.

Exploitation Scenarios

Attack Chain — Cross-Tenant Knowledge Base Sabotage

1. Reconnaissance and Target Identification: The attacker authenticates to the Open WebUI instance with a standard user account (registration may be open on many self-hosted deployments). They identify their own knowledge base ID by listing their collections via the API (e.g., GET /api/v1/knowledge). To discover a victim knowledge base, the attacker attempts to enumerate UUIDs or, more practically, leverages the fact that many deployments use sequential or guessable identifiers for directories and files within knowledge bases. If the instance exposes a search or admin-ish listing endpoint that does not enforce strict object-level visibility, the attacker can harvest target IDs directly.

2. Weaponization: The attacker crafts an HTTP request to the sync cleanup endpoint. The URL references the attacker-owned knowledge base to pass the authorization check:

   POST /api/v1/knowledge/{attacker_kb_id}/sync/cleanup
   Content-Type: application/json
   
   {
     "directory_ids": ["victim_directory_id_1", "victim_directory_id_2"],
     "file_ids": ["victim_file_id_1", "victim_file_id_2", ...]
   }
   

   The attacker swaps in victim-owned directory and file identifiers harvested during reconnaissance.

3. Execution: The server authorizes the attacker for {attacker_kb_id}, then proceeds to delete the directories and remove embeddings for the files referenced in the body. No ownership check associates the body IDs with the URL-context knowledge base. The request succeeds with HTTP 200.

4. Post-Exploitation Impact: The victim's knowledge base loses directory structure and file-embedding mappings. Documents silently disappear from RAG retrieval results. Chat-with-file queries referencing those documents return empty or degraded results, effectively executing a denial-of-service against the AI-assisted knowledge management system. The attacker can repeat this process to systematically destroy a victim's knowledge base contents without ever reading the documents. If the deleted embeddings are not backed up or re-ingested, the damage is persistent. In a multi-tenant deployment (e.g., an organization serving different teams or external clients), this enables cross-tenant sabotage with no forensic trace beyond API access logs showing a legitimate authorized session.

Impact Assessment

CVSS Rationale: The score of 4.3 (Medium) reflects low exploitation complexity (AC:L), network exploitability (AV:N), low privilege requirement (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), meaning the compromise stays within the web application's security boundary. Integrity impact is Low (I:L) and Availability is Low (A:N in the vector string actually shows A:N, but the deletion behavior implies availability degradation — however we follow the published vector strictly). Confidentiality is unaffected (C:N).

Business Impact:

• Data Integrity Loss: Unauthorized deletion of knowledge base structures corrupts organizational knowledge repositories.
• Availability Degradation: RAG-powered chat assistants return incomplete results, degrading user trust and operational workflows.
• Multi-Tenant Risk: In SaaS or multi-department deployments, cross-tenant attacks enable targeted sabotage that is difficult to attribute.
• Compliance Implications: Destruction of managed document-derived embeddings may violate data retention policies even though raw files may remain.

Affected Systems: All self-hosted Open WebUI deployments running ≥0.9.6 and <0.11.0 with knowledge base features enabled and multiple users having write access to at least one knowledge base.

Blast Radius: Limited to knowledge base metadata and embeddings — not a full system takeover. However, the attack is repeatable and can be executed by any authenticated user, making it a viable tool for persistent, low-noise disruption.

Detection Guidance

Sigma Rule

title: Open WebUI - Cross-Knowledge Base Sync Cleanup (CVE-2026-70488)
id: 4a1f8c9e-2b3d-4e5f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects sync cleanup requests where directory/file IDs in the body do not match the knowledge base in the URL, indicating potential CVE-2026-70488 exploitation.
author: Valtersit Threat Intelligence
logsource:
  category: webserver
  product: open-webui
detection:
  selection:
    http.method: POST
    http.url|contains: '/sync/cleanup'
    http.url|contains: '/api/v1/knowledge/'
  filter_known:
    http.response.status_code: 200
  condition: selection and filter_known
fields:
  - client.ip
  - http.url
  - http.request.body
  - http.response.status_code
falsepositives:
  - Legitimate cleanup operations on the same knowledge base ID in URL and body
level: medium
tags:
  - attack.t1190
  - cve.2026-70488
  - cwe.639

YARA Rule

rule OpenWebUI_CVE_2026_70488_SyncCleanup
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP request bodies to Open WebUI sync cleanup endpoints that may indicate cross-knowledge-base deletion attempts (CVE-2026-70488)"
        reference = "CVE-2026-70488"
        date = "2026-01-01"
        cve = "CVE-2026-70488"
        score = 60

    strings:
        $sync_cleanup = "/sync/cleanup"
        $kb_url = "/api/v1/knowledge/"
        $dir_ids = "directory_ids"
        $file_ids = "file_ids"
        $json_body = "{"

    condition:
        (uint16(0) == 0x0d0a or uint16(0) == 0x0a0d) and
        any of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SERVER Open WebUI CVE-2026-70488 Cross-KB Sync Cleanup Attempt";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"/api/v1/knowledge/";
    http.uri; content:"/sync/cleanup";
    http.request_body; content:"directory_ids";
    http.request_body; content:"file_ids";
    classtype:attempted-admin;
    sid:7048801;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-70488, cwe CWE-639;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-70488;
)

Elastic Detection

query: |
  sequence by host.name, http.request.body.content with maxspan=30s
    [any where event.category == "web" and http.request.method == "POST" and
       http.request.uri contains "/sync/cleanup" and
       http.request.uri contains "/api/v1/knowledge/"]
    [any where event.category == "web" and
       http.request.body.content contains "directory_ids" or
       http.request.body.content contains "file_ids"]

correlation:
  - name: Open WebUI CVE-2026-70488 Cross-KB Deletion Indicator
    index: winlogbeat-*, filebeat-*, logs-*
    threshold: 1
    timeframe: 1m
    query:
      - event.category: web
        and http.request.method: POST
        and http.request.uri: *sync/cleanup*
        and http.response.status_code: 200
    action:
      - create_alert

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path LIKE "%/sync/cleanup" AND uri_path LIKE "%/api/v1/knowledge/%"
| rex field=_raw "POST (?<url>\S+)"
| rex field=url "knowledge/(?<kb_url_id>[^/]+)/sync/cleanup"
| rex field=_raw "\"directory_ids\":\[(?<dir_ids>.*?)\]"
| rex field=_raw "\"file_ids\":\[(?<file_ids>.*?)\]"
| eval kb_match=if(kb_url_id==extract_kb_from_body(), "yes", "no")
| where kb_match != "yes"
| stats count by src_ip, uri_path, dir_ids, file_ids, _time
| sort - _time

Note: Splunk deployments should implement custom parsing if their TA for Open WebUI extracts body parameters. The above leverages raw _raw extraction to correlate URL-knowledge-base ID with body parameters; anomaly detection is triggered when they diverge.

Wazuh OSSEC Rule

<group name="openwebui,">
  <rule id="697331" level="10" frequency="5" timeframe="60">
    <if_sid>OPSEC_GROUP_ID</if_sid>
    <match>/api/v1/knowledge/.*/sync/cleanup</match>
    <match>directory_ids</match>
    <match>file_ids</match>
    <description>Open WebUI sync cleanup request with possible cross-knowledge-base deletion attempts (CVE-2026-70488)</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Reference Rules (must be previously defined in Wazuh):

<group name="web,">
  <rule id="OPSEC_GROUP_ID" level="1">
    <decoded_as>web</decoded_as>
    <description>Web server event</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed).

Immediate mitigations (before patching):

1. Restrict Write Access: Audit and minimize the number of users with write permission to any knowledge base. Since the attack requires authenticated write access to at least one knowledge base, reducing the write-privileged user population reduces exploit surface.
2. Disable Knowledge Base Sync Cleanup: If the sync cleanup feature is not essential, disable it via environment configuration or feature flags to eliminate the vulnerable endpoint.
3. Network Segmentation: Place Open WebUI behind a reverse proxy with strict egress filtering. Require VPN or private network access for all authenticated sessions.
4. Monitor API Access Logs: Alert on unusual patterns of /sync/cleanup POST requests, especially from accounts with minimal legitimate use of cleanup functionality. If anomalies are found, revoke the account and inspect the knowledge base for deleted directories or missing embeddings.

Patch/upgrade steps:

1. Upgrade Open WebUI to version 0.11.0 or later. The patched version validates that every directory ID and file ID in the request body belongs to the knowledge base referenced in the URL. Verify the upgrade on a staging instance first.
2. Verify patch integrity: Compare checksums of the published release artifacts (per vendor release notes) to mitigate supply-chain tampering.
3. After upgrade, run a functional test: create a second knowledge base as a test user and attempt a cross-KB cleanup with a victim KB ID — the request should be rejected with a 403.

Long-term hardening:

1. Adopt Object-Level Authorization Patterns: Ensure all future endpoints cross-validate every user-supplied identifier against the authenticated context — never trust URL parameters alone.
2. Enable Audit Logging: Ensure Open WebUI audit logs capture request bodies (or at least identifiers) for POST requests to management endpoints. This facilitates incident response and forensic analysis.
3. Backup Knowledge Base Metadata: Implement scheduled backups of knowledge base directory structures and embedding mappings to recover from destructive actions.
4. Regular Patch Cadence: Subscribe to Open WebUI security advisories and apply patches within 48 hours for Medium-severity issues.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-70488 — Official CVE record with CVSS vector and description.
2. Open WebUI Release Notes: https://github.com/open-webui/open-webui/releases/tag/v0.11.0 — Claims the fix in version 0.11.0.
3. Open WebUI GitHub Repository: https://github.com/open-webui/open-webui — Source code and issue tracker for vulnerability analysis and patch verification.
4. CWE-639 Reference: https://cwe.mitre.org/data/definitions/639.html — Weakness class documentation for authorization bypass through user-controlled keys.
5. EPSS Data (FIRST.org): https://www.first.org/epss/api — External threat likelihood metric supporting the low active-exploitation probability (0.213% EPSS as of this report).

Exploit-in-the-Wild Evidence: As of this report’s publication, there are no confirmed reports of active exploitation. The CVE is NOT listed on the CISA KEV catalog. A public PoC description exists in security research circles, but no weaponized exploit code has been confirmed. The EPSS percentile (11.7%) indicates that exploitation likelihood is low—consistent with the Medium severity rating. Organizations should treat this as a legitimate, patched vulnerability requiring standard patch-management hygiene rather than an emergency response.