CVE-2026-87997

Executive Summary

CVE-2026-87997 is an authorization flaw (CWE-639, authorization bypass through user-controlled key) in Open WebUI, a self-hosted AI chat platform. From version 0.10.0 until 0.11.1, the chat completion endpoints in backend/open_webui/main.py copied a client-supplied folder_id into a newly created chat without enforcing the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could force an attacker-controlled chat entry into a folder they could not legitimately write to, making it visible to authorized folder readers.

Technical Analysis

Open WebUI exposes OpenAI-compatible chat completion endpoints, specifically POST /api/chat/completions and POST /api/v1/chat/completions, implemented in backend/open_webui/main.py. These endpoints create chat records and, per the advisory, accept a client-supplied folder_id value that is copied into the new chat object.

The dedicated chat management routes apply a write-access check against the target folder before associating a chat with it. The chat completion endpoints, however, did not apply that same folder write-access check during the affected version range (0.10.0 through 0.11.0). This is a classic CWE-639 (Authorization Bypass Through User-Controlled Key): the security decision relies on an identifier (folder_id) that the client controls, and the code path performs insufficient authorization validation on that key.

The net effect is a horizontal/vertical authorization inconsistency between two code paths that operate on the same resource type (folders containing chats). One path (dedicated chat routes) is correctly protected; the vulnerable path (chat completion endpoints) is not. Because the vulnerable endpoints are authentication-gated — the attacker must be an authenticated user — the exploit requires a valid session, which is reflected in the CVSS vector (PR:L, Low privileges required).

The attack does not require user interaction (UI:N), is network-reachable (AV:N), and has low attack complexity (AC:L). The resulting integrity impact is Low (I:L), because the attacker can inject content (a chat entry) into a folder they do not own or control write access to, but does not gain read access to protected data (C:N) and does not disrupt availability (A:N). The scope is unchanged (S:U) — the vulnerable component and impacted component are the same.

No public proof-of-concept, Nuclei template, or exploit code was identified in the source data. No EPSS score has been assigned by FIRST.org as of this writing, and the vulnerability is not listed in the CISA KEV catalog.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-639) and the technical facts stated in the advisory. No specific code patterns, function names, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies a reachable Open WebUI instance running a vulnerable version (0.10.0 ≤ version < 0.11.1). Open WebUI deployments are commonly self-hosted and exposed on the internet or on internal networks. The attacker obtains or already holds an authenticated account (or low-privileged credentials), satisfying the PR:L prerequisite.

2. Discovery of the folder identifier. The attacker must know the identifier of a shared folder they do not have write access to (read-only or no access). Such identifiers can be disclosed through shared folder links, collaboration features, API responses, organizational leakage, or enumeration of folder identifiers where the deployment exposes them. The advisory states the attacker "knew a shared folder identifier," so obtaining this key is a precondition for exploitation.

3. Triggering the authorization bypass. The attacker sends a crafted request to POST /api/chat/completions or POST /api/v1/chat/completions, supplying the target folder_id along with chat content they control. Because the endpoint fails to apply the folder write-access check, the request succeeds and the attacker-controlled chat is created inside the target folder rather than being rejected — this is the insecure-direct-object-reference-style bypass (CWE-639) at the heart of the flaw.

4. Post-exploitation impact. The injected chat entry becomes visible to authorized readers of that folder, allowing the attacker to plant content — potentially misleading, malicious, or contextually deceptive material — in a workspace they were never authorized to modify. The advisory scopes the impact as an integrity violation (I:L): unauthorized insertion, not data exfiltration or denial of service.

Impact Assessment

• Confidentiality: None (C:N) — the attacker does not read data they were not already entitled to.
• Integrity: Low (I:L) — unauthorized insertion/modification of chat content within a folder the attacker cannot legitimately write to.
• Availability: None (A:N).
• Privileges required: Low (PR:L) — an authenticated account is required.
• User interaction: None (UI:N).
• Base score: 4.3 (Medium).

Blast radius. Any Open WebUI instance in the affected version range with multi-user folder sharing enabled is exposed. The practical risk is content injection into shared team workspaces — a mechanism that supports social engineering, disinformation, or the spread of malicious prompt content to other users who trust the folder's contents. Because Open WebUI is frequently used as a self-hosted internal AI platform, injected chats could be consumed by automated downstream tooling and by human readers alike. The relatively low CVSS score reflects the narrow integrity-only impact and the authenticated precondition, but in collaborative deployments the reputational and trust-erosion effect can be disproportionate.

Threat actor relevance. No exploit-in-the-wild evidence, no KEV listing, and no attributed campaigns exist in the provided data. The flaw is nonetheless attractive to low-skilled authenticated insiders or compromised accounts seeking to seed content into restricted workspaces.

Detection Guidance

Sigma Rule

title: Open WebUI Folder Write-Access Bypass via Chat Completion Endpoints
id: 9c1f4a72-3d5b-4e21-a8c6-1b7f0e2d9a44
status: experimental
description: Detects requests to Open WebUI chat completion endpoints that supply a folder_id, the vector for CVE-2026-87997 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87997
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem:
      - '/api/chat/completions'
      - '/api/v1/chat/completions'
  selection_folder:
    cs-uri-query|contains: 'folder_id'
  condition: selection_endpoint and selection_folder
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate clients that pass folder_id to completion endpoints where the folder is legitimately writable by the caller.
level: medium

YARA Rule

rule CVE_2026_87997_OpenWebUI_FolderBypass_HTTP
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP traffic referencing Open WebUI chat completion endpoints with a client-supplied folder_id (CVE-2026-87997)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87997"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ep1 = "/api/chat/completions" ascii nocase
        $ep2 = "/api/v1/chat/completions" ascii nocase
        $fid = "folder_id" ascii nocase
        $post = "POST " ascii

    condition:
        $post and ($ep1 or $ep2) and $fid
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87997 Open WebUI folder_id authorization bypass attempt on chat completion endpoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/chat/completions"; http.uri; content:"folder_id"; http.uri; content:"/api/v1/chat/completions"; classtype:attempted-user; reference:cve,2026-87997; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87997; sid:202687997; rev:1;)

alert http any any -> any any (msg:"CVE-2026-87997 Open WebUI folder_id authorization bypass attempt on v1 chat completion endpoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/chat/completions"; http.uri; content:"folder_id"; classtype:attempted-user; reference:cve,2026-87997; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87997; sid:202687998; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST"
      and (http.request.path == "/api/chat/completions" or http.request.path == "/api/v1/chat/completions")
      and http.request.body.text wildcard "*folder_id*" ]

Splunk SPL Query

index=web OR index=proxy
(method="POST" OR http_method="POST")
(uri_path="/api/chat/completions" OR uri_path="/api/v1/chat/completions" OR url="*/api/chat/completions*" OR url="*/api/v1/chat/completions*")
(folder_id OR uri_query="*folder_id*" OR request_body="*folder_id*")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as endpoint values(clientip) as src_ip by user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,open_webui,cve-2026-87997,">
  <rule id="2026879" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">/api/chat/completions|/api/v1/chat/completions</field>
    <field name="method">POST</field>
    <regex type="pcre2">folder_id</regex>
    <description>CVE-2026-87997: Open WebUI chat completion request with folder_id - possible folder write-access authorization bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87997,attempted_user,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Restrict network access to the chat completion endpoints (/api/chat/completions, /api/v1/chat/completions) so that only trusted clients can reach them, using a reverse-proxy allowlist or network ACLs where operational constraints permit.
• Audit and, where feasible, disable or minimize multi-user folder sharing until the instance can be upgraded, reducing the exposure of shared folder identifiers.
• Monitor authentication logs for low-privileged accounts issuing requests to the completion endpoints with a folder_id parameter, per the detection rules above.
• Treat folder identifiers as sensitive and review any feature that discloses them broadly (shared links, API responses, exports).

2) Patch / upgrade steps

• Upgrade Open WebUI to 0.11.1 or later. Version 0.11.1 applies the folder write-access check to the chat completion endpoints that the dedicated chat routes already enforced.
• Verify the deployed version after upgrade and confirm the fix is present in backend/open_webui/main.py for the completion routes.
• Because patch confidence is 0/4 and no vendor advisory URL or commit hash was supplied in the source data, validate the fix by testing that a completion request referencing a folder the caller cannot write to is rejected after upgrade.

3) Long-term hardening

• Centralize authorization logic so that resource-key checks (such as folder write access) are applied uniformly across all code paths that consume client-supplied identifiers, preventing this class of CWE-639 inconsistency.
• Adopt a policy of never trusting client-supplied object identifiers for authorization decisions without server-side validation.
• Enforce least-privilege folder roles, and require explicit write permission before any object association.
• Maintain a routine upgrade cadence for self-hosted collaboration platforms and monitor vendor releases for authorization fixes.

References

• NVD — CVE-2026-87997: https://nvd.nist.gov/vuln/detail/CVE-2026-87997
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• Open WebUI project repository / release notes for version 0.11.1 (verify the fix for the chat completion endpoint folder write-access check)
• FIRST EPSS — no score assigned as of this writing (https://www.first.org/epss)
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-87997 is not listed (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

Exploit-in-the-wild / campaign note: No public PoC, exploit code, Nuclei template, EPSS score, KEV listing, or attributed threat actor campaign is associated with CVE-2026-87997 in the available data. The attack chain described above is inferred from the vulnerability class (CWE-639) and the technical facts stated in the advisory.