Self-Hosted AI Platform Vulnerability in Open WebUI
CVE-2026-70483

3.1LOW

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
4 August 2026

What is CVE-2026-70483?

The vulnerability in Open WebUI allows any authenticated user to cancel in-progress tasks for another user's chat by exploiting the DELETE /api/v1/chats/{id} endpoint. This flaw exists in versions 0.9.6 through 0.11.0, where the platform fails to verify the caller's permissions before terminating a chat session. While the task cancellation does not delete or expose chat data, it can disrupt users' experiences significantly. This issue was rectified in version 0.11.0.

Affected Version(s)

open-webui >= 0.9.6, < 0.11.0

References

https://github.com/open-webui/open-webui/security/advisor...
x_refsource_CONFIRM
https://github.com/open-webui/open-webui/pull/27006
x_refsource_MISC
https://github.com/open-webui/open-webui/commit/4f93c3e36...
x_refsource_MISC

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.