CVE-2026-70488: Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base.