CVE-2026-70483
⚪ Do wiadomości
Błąd w Open WebUI pozwala na przerwanie zadań czatu przez uwierzytelnionego użytkownika.
CVSS
3.1
EPSS
0.3%
Exploit
poc
Vendor
openwebui
Opis źródłowy (NVD)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort that user's running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 3.1 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.3% |
| Opublikowano (NVD) | 2026-08-04 20:16:55 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-18 14:46:24 UTC |
Referencje
- https://github.com/open-webui/open-webui/commit/4f93c3e36c1734342a32c312bdb0516c66d8e93c ([email protected]) [Patch]
- https://github.com/open-webui/open-webui/pull/27006 ([email protected]) [Patch, Vendor Advisory]
- https://github.com/open-webui/open-webui/releases/tag/v0.11.0 ([email protected]) [Release Notes]
- https://github.com/open-webui/open-webui/security/advisories/GHSA-3vf6-64vr-3g56 ([email protected]) [Exploit, Patch, Vendor Advisory]