Summary
Open WebUI contains an authorization flaw in shared chat folder deletion, allowing a collaborator with write access to act on chats and messages owned by another user. Under affected sharing and folder-hierarchy conditions, the collaborator may permanently delete the owner's content or force-move chats from the owner's folder subtree.
Affected context
The issue occurs in deployments using shared chat folders and inherited permissions. A user with write access to a shared folder may reach the folder deletion workflow, where authorization for the parent folder is not consistently applied to descendant folders and their contents. The risk depends on the folder hierarchy, sharing configuration, and permissions granted to the collaborator.
Exploit preconditions
- Attack surface: Authenticated Open WebUI folder-management API - Required access: Write access to a shared chat folder, without requiring
ownership of the folder
- Trigger point: Deletion of a shared folder through the folder API - Relevant condition: The folder contains owner-controlled chats, messages, or
subfolders with inherited permissions
- Why exploitation is possible: The subfolder authorization check accepts an
inherited write grant instead of requiring ownership or administrator
privileges, while subsequent operations use the folder owner's identity
Why this happens
The underlying defect is inconsistent authorization enforcement across a hierarchical resource operation. The parent-folder check permits a collaborator with write access to enter a destructive workflow, but the descendant check does not require ownership or administrative authority before applying the operation to owner-controlled resources. This maps primarily to CWE-862, Missing Authorization, and also relates to CWE-863, Incorrect Authorization, because an insufficient permission is treated as adequate for a sensitive action.
Potential impact
- A collaborator may permanently delete chats and messages belonging to the folder owner.
- An attacker may destroy an owner's folder subtree.
- Chats may be force-moved out of the owner's folder when content deletion is disabled.
- Users may experience unauthorized data loss, loss of organization, or loss of trust in shared workspaces.
General mitigation guidance
Mitigation generally focuses on enforcing authorization consistently across every resource affected by a hierarchical operation. Destructive actions should require verified ownership or administrator authority, and inherited write access should not implicitly grant delete rights over another user's content. Authorization should be evaluated against each target resource before mutation, with secure-by-default behavior that denies ambiguous or incomplete permission states. Systems should also reduce reliance on client-supplied ownership context, apply least privilege to collaboration roles, and preserve audit records for destructive folder operations.
How teams detect issues like this
Detection can include static and dynamic checks that compare authorization requirements for parent resources with those applied to descendants. Code review should examine cascade operations, inherited permissions, identity binding, and any path where write access is treated as delete authority. API policy tests should verify that collaborators cannot delete or relocate resources owned by other users, including nested folders and empty-content variants. Audit monitoring can flag destructive folder actions performed by non-owners, while automated security review tools may help identify missing authorization checks.
