CVE-2026-70487

Katalog CVE

CVSS 6.5 · Medium EPSS 0,42%

Kerentanan Missing Authorization pada openwebui open webui. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file id could have the builtin knowledge tools return indexed chunks from that file, causing a read-only cross-user confidentiality loss while leaving knowledge-base permissions and saved workspace model validation unaffected. This issue is fixed in 0.11.0.

Rincian

Terbit di NVD

4 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/security/advisories/GHSA-6xhv-rxhv-pwm4 patch · advisory vendor
• https://github.com/open-webui/open-webui/commit/305880f2e2aeb2dda2f4b2a18a20bdcd558f7134 patch
• https://github.com/open-webui/open-webui/releases/tag/v0.11.0 release notes