{
 "id": "AIR-2026-0300",
 "slug": "cve-2026-109284-open-webui-chat-fork-handler-improper-author",
 "title": "CVE-2026-109284: Open WebUI chat fork handler improper authorization flaw",
 "summary": "Open WebUI suffered from an improper authorization vulnerability in the chat fork handler allowing forked chats to be placed into folders without write access. Downgraded shared folder members could insert attacker-controlled chats visible to folder owners.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-10-12",
 "incident_date_precision": "day",
 "first_reported": "2026-10-12",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109284",
   "publisher": "NVD",
   "title": "CVE-2026-109284: Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places…",
   "published_at": "2026-10-12"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-109284",
  "authorization",
  "access-control"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}