Read the docs
TI-2026-49254 Aliases CVE-2026-70481GHSA-mj5r-jf49-m3w7

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Priority LOW 25CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant message, while group and direct message handlers enforced authorship. This issue is fixed in 0.11.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00427 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed open-webui (open-webui): 0.11.0open-webui (PyPI): 0.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-webuiopen-webui0.5.0 to before 0.11.00.11.0Patch availableCNA
—open-webui (PyPI)0.5.0 to before 0.11.00.11.0Patch availableGHSA-mj5r-jf49-m3w7
  • open-webui Vendoropen-webui Affected 0.5.0 to before 0.11.0 Fixed in 0.11.0 Patch available CNA
  • open-webui (PyPI) Vendor— Affected 0.5.0 to before 0.11.0 Fixed in 0.11.0 Patch available GHSA-mj5r-jf49-m3w7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*0.5.0 to before 0.11.0Vulnerableopen-webui
  • cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* Versions 0.5.0 to before 0.11.0 Vulnerable ·open-webui

Remediation

  • Fix · CNA open-webui (open-webui) Fixed in 0.11.0
  • Fix · GHSA-mj5r-jf49-m3w7 open-webui (PyPI) Fixed in 0.11.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-70481
  2. 2026-10-03 Alias added: GHSA-mj5r-jf49-m3w7

References

Exploit 1

Patch 2

Other 2

  • TI-2024-06216 Open WebUI Arbitrary File Upload + Path Traversal CVSS 3.1HIGH 8.8
  • TI-2024-07467 Improper Authentication in open-webui/open-webui CVSS 3.1HIGH 8.2
  • TI-2026-42359 Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id CVSS 3.1CRITICAL 9.0
  • TI-2026-40759 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation CVSS 4.0CRITICAL 9.0
  • TI-2024-07431 Cross-site Scripting (XSS) in open-webui/open-webui CVSS 3.0CRITICAL 9.0
  • TI-2026-60021 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin CVSS 3.1HIGH 8.7
See all 154 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences