VULNERABILITY INTELLIGENCE

CVE-2026-70483

CVSS score3.1 LOW

EPSS probability0.46%

CISA KEVNot currently listed

Published2026-08-04

Last modified2026-09-18

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort that user's running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.

Weakness classification

security-advisories@github.com: CWE-862

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Patch, Vendor Advisory
security-advisories@github.com — Release Notes
security-advisories@github.com — Exploit, Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Patch, Vendor Advisory