Knowledge-base destruction via unauthorized collection overwrite

Missing authorization in Open WebUI before 0.9.0 allows remote authenticated users to destroy or poison another user's knowledge base. The process_web and process_youtube endpoints pass an unchecked collection_name to save_docs_to_vector_db, which deletes the selected vector collection before storing attacker-controlled content when overwrite is true. Exploitation requires a valid account and the target collection name; it replaces stored embeddings and corrupts subsequent RAG answers.