Vulnerability Report

CVE-2026-70481

Title: Message modification/deletion bypass in Open WebUI

Other

Proof Of Concept

PoC Available for CVE-2026-70481

CWE Category CWE-284
Published Date Aug 04, 2026
Modified Date Aug 05, 2026
Exploit Status Available
Score 5.4 CVSS v3.1
Exploit Probability (EPSS)
0.30%

Vulnerability Summary

CVE-2026-70481: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant message, while group and direct message handlers enforced authorship. This issue is fixed in 0.11.0.

Impacted Vendors

Analysis in Progress...

Reference Links

https://github.com/open-webui/open-webui/commit/c609ec41154fa092fa0af80d9d365de06b666286 https://github.com/open-webui/open-webui/pull/27197 https://github.com/open-webui/open-webui/releases/tag/v0.11.0 https://github.com/open-webui/open-webui/security/advisories/GHSA-mj5r-jf49-m3w7
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
5.4
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-70481 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/Foxer131/CVE-2026-70481
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected Stack

No specific products linked.