Auth bypass in Open-webui
CVE-2026-70483
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any auth…
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Open-webui — versions >= 0.9.6, < 0.11.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-70483?
- CVE-2026-70483 is a low-severity vulnerability in Open-webui, classified under Missing Authorization. CVSS score: 3.1/10. Published 2026-08-04.
- How severe is CVE-2026-70483?
- Low severity. CVSS v3 base score is 3.1 out of 10.