CVE-2026-70483CWE-862broken-access-control

CVE-2026-70483

Low · published August 5, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort that user's running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-05T00:16Z
Affected products (1)
ProductVersionsFixed in
openwebui/open_webui≥ 0.9.6, < 0.11.00.11.0
References (5)
https://github.com/open-webui/open-webui/pull/27006 · [email protected]https://github.com/open-webui/open-webui/releases/tag/v0.11.0 · [email protected]https://github.com/open-webui/open-webui/security/advisories/GHSA-3vf6-64vr-3g56 · [email protected]https://github.com/open-webui/open-webui/security/advisories/GHSA-3vf6-64vr-3g56 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/open-webui/open-webui/commit/4f93c3e36c1734342a32c312bdb0516c66d8e93c · [email protected]
EPSS history
Timeline
  • 04 AUG 19:54Z
    Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
    cvelistv5