CVE-2026-70484

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70484
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70484.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70484
Aliases
Published
2026-08-04T19:56:54.210Z
Modified
2026-08-10T11:40:29.836643111Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
Details

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied imagegeneration flag and did not re-check the features.imagegeneration permission that the direct image routes and native function-calling path enforce. An authenticated user whose image-generation permission had been revoked could still consume the operator's configured image provider through chat completions, spending API credits and provider quota and writing generated files to operator storage, without exposing provider credentials or other users' data. This issue is fixed in 0.11.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70484.json",
    "cwe_ids": [
        "CWE-862",
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type
GIT
Repo
https://github.com/open-webui/open-webui
Events
Introduced
6adde203cd292a9e3af9c64a2ae36b603fed096a
Fixed
897d69a35c65f8ab54583bb9ca8dc74eab7bcd29
Fixed
f9590b8017199e56d5e953657e6498e3cef1d246
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.7.0"
        },
        {
            "fixed": "0.11.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.7.0
v0.7.1
v0.7.2
v0.8.0
v0.8.1
v0.8.10
v0.8.11
v0.8.12
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70484.json"