Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.12"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44550"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T19:38:54Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Mass Assignment via Pydantic extra=\u0027allow\u0027 Allows Creating Folders in Other Users\u0027 Accounts\n\n## Affected Component\n\nFolder creation endpoint and form model:\n- `backend/open_webui/models/folders.py` (lines 72-77, `FolderForm` with `extra=\u0027allow\u0027`)\n- `backend/open_webui/models/folders.py` (lines 95-106, `insert_new_folder` dict construction)\n- `backend/open_webui/routers/folders.py` (line 119, `create_folder` endpoint)\n\n## Affected Versions\n\nCurrent main branch (commit `6fdd19bf1`) and likely all versions since `FolderForm` adopted `extra=\u0027allow\u0027`.\n\n## Description\n\n`FolderForm` uses `model_config = ConfigDict(extra=\u0027allow\u0027)`, which permits arbitrary fields to pass through Pydantic validation and be included in `model_dump(exclude_unset=True)`. In `insert_new_folder`, the server-assigned `user_id` is placed at the start of the dict and then overwritten by the spread of form data:\n\n```python\n# models/folders.py:95-106\nfolder = FolderModel(\n    **{\n        \u0027id\u0027: id,                                              # server\n        \u0027user_id\u0027: user_id,                                    # server \u2014 overwritten below\n        **(form_data.model_dump(exclude_unset=True) or {}),    # user-controlled (extra=\u0027allow\u0027)\n        \u0027parent_id\u0027: parent_id,\n        \u0027created_at\u0027: int(time.time()),\n        \u0027updated_at\u0027: int(time.time()),\n    }\n)\n```\n\nBecause `FolderModel` declares `user_id: str` as a real field (not just a form extra), any attacker-supplied `user_id` in the POST body is accepted by the model and persisted on the `Folder` row.\n\n## Attack Scenario\n\n1. Attacker discovers a victim\u0027s user ID. User UUIDs commonly leak via the user search endpoint (`GET /api/v1/users/search`, intentionally accessible to verified users for sharing UI), shared chat metadata, or channel member lists.\n2. Attacker sends:\n   ```\n   POST /api/v1/folders/\n   {\n     \"name\": \"Important: Click here\",\n     \"user_id\": \"\u003cvictim_user_id\u003e\",\n     \"meta\": {\"icon\": \"warning\"},\n     \"data\": {...}\n   }\n   ```\n3. Pydantic accepts the extra `user_id` field (allowed by `extra=\u0027allow\u0027`).\n4. `insert_new_folder` spreads the form data over the server-set `\u0027user_id\u0027: user_id`, overwriting it with the attacker\u0027s value.\n5. The `Folder` row is persisted with `user_id = \u003cvictim_user_id\u003e`.\n6. The victim sees the attacker-planted folder in their UI on next load because `GET /api/v1/folders/` filters by the viewer\u0027s own `user_id`.\n\nThe attacker can repeat this to plant multiple folders, use crafted `name` values for phishing (\"Click here to recover account\" / \"Security alert\"), and abuse the `meta` and `data` fields to add visual elements that further mimic legitimate content.\n\n## Impact\n\n- Unauthorized write into victim\u0027s folder tree\n- Phishing surface: attacker-controlled `name`, `meta`, and `data` render in the victim\u0027s UI in a trusted context\n- DoS / spam: attacker can flood a victim with arbitrary folders; victim must manually delete each one\n- Attacker cannot read the folder back \u2014 all read paths filter by the caller\u0027s own `user_id` \u2014 so confidentiality is preserved, but integrity and trust are compromised\n\n## Preconditions\n\n- Attacker must have an authenticated account with `features.folders` permission (default for all users)\n- Attacker must know or guess the victim\u0027s user UUID (obtainable through various non-sensitive endpoints)",
  "id": "GHSA-hr43-rjmr-7wmm",
  "modified": "2026-05-08T19:38:54Z",
  "published": "2026-05-08T19:38:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-hr43-rjmr-7wmm"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI\u0027s Mass Assignment via Pydantic extra=\u0027allow\u0027 Allows Creating Folders in Other Users\u0027 Accounts"
}