CVE-2026-70488

Katalog CVE

CVSS 4.3 · Medium EPSS 0,37%

Kerentanan Authorization Bypass Through User-Controlled Key pada openwebui open webui. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base. A user with write access to one knowledge base could delete directories and remove file embeddings from another knowledge base, causing documents to drop out of retrieval results and breaking chat-with-file for targeted documents without disclosing contents. This issue is fixed in 0.11.0.

Rincian

Terbit di NVD

4 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/pull/26722 patch · advisory vendor
• https://github.com/open-webui/open-webui/security/advisories/GHSA-jxc9-xmc4-gr23 patch · advisory vendor
• https://github.com/open-webui/open-webui/commit/707efeaed7992dd9896d5928559458f228b9a539 patch
• https://github.com/open-webui/open-webui/releases/tag/v0.11.0 release notes