Veille CVE
CVE-2026-70483
4.3 MoyenneDescription
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort that user's running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 3.1 Faible | security-advisories@github.com | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | 4.3 Moyenne | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Faiblesses (CWE)
Références
- https://github.com/open-webui/open-webui/commit/4f93c3e36c1734342a32c312bdb0516c66d8e93c Patch
- https://github.com/open-webui/open-webui/pull/27006 PatchVendor Advisory
- https://github.com/open-webui/open-webui/releases/tag/v0.11.0 Release Notes
- https://github.com/open-webui/open-webui/security/advisories/GHSA-3vf6-64vr-3g56 ExploitPatchVendor Advisory
- https://github.com/open-webui/open-webui/security/advisories/GHSA-3vf6-64vr-3g56 ExploitPatchVendor Advisory