CVE-2026-70481

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.5.0 through 0.10.9

Description In standard channels, the message update and delete handlers fail to verify if the caller is the original author of the message. Since write access is the same permission required to post a message, any authenticated user with the user role and write access to a shared standard channel can modify or permanently delete messages sent by other participants. This allows an attacker to forge content under another user's name or destroy channel history. This issue occurs when the ENABLE CHANNELS setting is enabled by an administrator.

Technical details include the following affected API endpoints:

Recommendations Update Open WebUI to version 0.11.0.