CVE-2026-70494

Katalog CVE

CVSS 8.1 · High EPSS 0,55%

Kerentanan Missing Authorization pada openwebui open webui. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The cascade following the authorization check is bound to the folder owner's id, but the subfolder check accepted any inherited write grant instead of requiring ownership or administrator status. A collaborator can destroy the owner's subtree or force-move chats out of it when delete_contents=false. This issue is fixed in 0.11.0.

Rincian

Terbit di NVD

4 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/pull/27003 patch · advisory vendor
• https://github.com/open-webui/open-webui/security/advisories/GHSA-3cg5-48j3-v4gv patch · advisory vendor
• https://github.com/open-webui/open-webui/commit/915ef7d0798d3175819cedbb2f62d7bf0db78c98 patch
• https://github.com/open-webui/open-webui/releases/tag/v0.11.0 release notes