Low severity3.1NVD Advisory· Published Aug 4, 2026· Updated Sep 18, 2026
CVE-2026-70483
CVE-2026-70483
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort that user's running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
open-webuiPyPI | >= 0.9.6, < 0.11.0 | 0.11.0 |
Affected products
1- Range: 0.9.6 - 0.11.0
Patches
Vulnerability mechanics
References
5- github.com/open-webui/open-webui/commit/4f93c3e36c1734342a32c312bdb0516c66d8e93cnvdPatchWEB
- github.com/open-webui/open-webui/pull/27006nvdPatchVendor AdvisoryWEB
- github.com/open-webui/open-webui/security/advisories/GHSA-3vf6-64vr-3g56nvdExploitPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-3vf6-64vr-3g56ghsaADVISORY
- github.com/open-webui/open-webui/releases/tag/v0.11.0nvdRelease NotesWEB
News mentions
1- Open WebUI: 17 Vulnerabilities Disclosed Together, Patched in 0.11.0Vypr Intelligence · Aug 4, 2026