CVE-2026-70488

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70488
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70488.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70488
Aliases
Published
2026-08-04T20:35:44.235Z
Modified
2026-08-10T11:40:37.039288391Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Details

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base. A user with write access to one knowledge base could delete directories and remove file embeddings from another knowledge base, causing documents to drop out of retrieval results and breaking chat-with-file for targeted documents without disclosing contents. This issue is fixed in 0.11.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70488.json",
    "cwe_ids": [
        "CWE-639",
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type
GIT
Repo
https://github.com/open-webui/open-webui
Events
Introduced
1a97751e376e00a1897bc3679215ae1c7bd8fd42
Fixed
707efeaed7992dd9896d5928559458f228b9a539
Fixed
f9590b8017199e56d5e953657e6498e3cef1d246
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.9.6"
        },
        {
            "fixed": "0.11.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70488.json"