Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| open-webui | open-webui | affected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Open-webui
Subscribe
|
Open-webui
Subscribe
|
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-3vf6-64vr-3g56 | Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Tue, 04 Aug 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Open-webui
Open-webui open-webui |
|
| Vendors & Products |
Open-webui
Open-webui open-webui |
Tue, 04 Aug 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort that user's running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0. | |
| Title | Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint | |
| Weaknesses | CWE-862 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-08-04T19:54:35.579Z
Reserved: 2026-08-04T15:24:41.340Z
Link: CVE-2026-70483
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-04T21:45:04Z