Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

PYSEC-2026-4118

Revision 1

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

## Summary The chat-completions endpoint reads a folder id out of the request body and saves the newly created chat into that folder without checking that the caller is allowed to write there. Any authenticated user who knows a folder's id can put a chat of their own into another user's folder, including a shared folder where they hold read-only access and a folder they have no access to at all. The chat then shows up in that folder for everyone who can read it, under a title and with content the attacker controls. The dedicated chat-creation and chat-move endpoints already enforced this check, the chat-completions path did not. ## Preconditions - An authenticated account of any role. No elevated permission, no admin involvement. - Folders enabled, which is the default (`ENABLE_FOLDERS=true`, `USER_PERMISSIONS_FEATURES_FOLDERS=true`). - The attacker needs the target folder's id. A member of a shared folder gets it from the shared-folder listing. Sharing a folder with named users is available to ordinary users by default; only wildcard public sharing is gated. A folder that was never shared has an id the attacker cannot obtain through any endpoint available to them, so those folders are not practically reachable. - Releases before 0.10.0 contain the same missing check but have no read path that lists a folder's chats across owners, so the injected row was never visible to anyone. ## Impact The integrity of folder contents. An attacker who cannot write to a folder can place cha

GHSA-3pf7-q2g3-wj28

Primary source · Revision 1