CVE-2026-59217 Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Medium 4.3 Published 9 Jul 2026 Updated 14 Jul 2026

Read-only users can bypass write-access checks to add arbitrary files to knowledge bases via the file upload endpoint.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-59217?

CVE-2026-59217 is a medium-severity missing authorization vulnerability in Openwebui Open Webui, published on 9 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledge_id and auto-linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing read-only knowledge-base users to add arbitrary files. This issue is fixed in version 0.10.0.

Weakness: CWE-863, CWE-862

Which versions are affected by CVE-2026-59217?

3 open source packages ship an affected version, including open-webui. It affects 1 product.

Package	Affected	Fixed in
`open-webui` PyPI	All versions	`0.10.0`
`open-webui` PyPI	All versions	`0.10.0`
`open-webui` PyPI	All versions	`0.10.0`

Products include Openwebui Open Webui.

How do I fix CVE-2026-59217?

Upgrade open-webui to 0.10.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-59217 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59217 exists.

All Openwebui Open Webui vulnerabilities

Sources

Also known as GHSA-7r7x-gjvr-448g, PYSEC-2026-3593.