CVE-2026-70483

Katalog CVE

CVSS 4.3 · Medium EPSS 0,46%

Kerentanan Missing Authorization pada openwebui open webui. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort that user's running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.

Rincian

Terbit di NVD

4 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/pull/27006 patch · advisory vendor
• https://github.com/open-webui/open-webui/security/advisories/GHSA-3vf6-64vr-3g56 exploit · patch · advisory vendor
• https://github.com/open-webui/open-webui/commit/4f93c3e36c1734342a32c312bdb0516c66d8e93c patch
• https://github.com/open-webui/open-webui/releases/tag/v0.11.0 release notes