CVE-2026-70483

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-70483

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70483.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-70483

Aliases

Published

2026-08-04T19:54:35.579Z

Modified

2026-08-10T11:40:48.240892715Z

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Details

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort that user's running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70483.json"
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

1a97751e376e00a1897bc3679215ae1c7bd8fd42

Fixed

4f93c3e36c1734342a32c312bdb0516c66d8e93c

Fixed

f9590b8017199e56d5e953657e6498e3cef1d246

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.9.6"
        },
        {
            "fixed": "0.11.0"
        }
    ]
}

Affected versions

v0.*

v0.9.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70483.json"