CVE-2026-59212

🔶 medium

Summary

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_knowledge_file_access only checked read access while file write and delete routes later trusted object-derived access through writable model meta.knowledge entries, allowing a user with read-only knowledge file access to upgrade to file write or delete operations. This issue is fixed in version 0.10.0.

CVSS Score

5.4

Medium

EPSS Score

0.3

Exploit Probability

Published Date

2026-07-09

First Seen: 2026-07-10

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 22.6% of all 338,292 vulnerabilities in our database.

#261,731

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jul 9, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-07-10

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CWE IDs (Weakness Types)

CWE-863

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
openwebui	open_webui	Affected	v0.9.6

🔗 References 4

https://github.com/open-webui/open-webui/commit/17df...

Patch

https://github.com/open-webui/open-webui/pull/26032

Issue Tracking Patch

https://github.com/open-webui/open-webui/releases/ta...

Product Release Notes

https://github.com/open-webui/open-webui/security/ad...

Exploit Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-56398	⚠️ high	7.3	0.3	Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the ...	2026-07-15
CVE-2026-56400	⚠️ high	8.3	0.3	open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow...	2026-07-15
CVE-2026-59213	ℹ️ low	3.5	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all...	2026-07-09
CVE-2026-59214	⚠️ high	7.3	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs c...	2026-07-09
CVE-2026-59215	ℹ️ low	3.1	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread pa...	2026-07-09
CVE-2026-59216	⚠️ high	7.7	0.3	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call de...	2026-07-09

These CVEs affect the same products