CVE-2026-70481

Katalog CVE

CVSS 5.4 · Medium EPSS 0,43%

Kerentanan Improper Access Control pada openwebui open webui. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant message, while group and direct message handlers enforced authorship. This issue is fixed in 0.11.0.

Rincian

Terbit di NVD

4 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-862: Missing Authorization

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/pull/27197 patch · advisory vendor
• https://github.com/open-webui/open-webui/security/advisories/GHSA-mj5r-jf49-m3w7 exploit · patch · advisory vendor
• https://github.com/open-webui/open-webui/commit/c609ec41154fa092fa0af80d9d365de06b666286 patch
• https://github.com/open-webui/open-webui/releases/tag/v0.11.0 release notes