PT-2026-67834 · Unknown · Open-Webui
CVE-2026-70481
·
Published
2026-08-04
·
Updated
2026-08-10
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Open WebUI versions 0.5.0 through 0.10.9
Description
In standard channels, the message update and delete handlers fail to verify if the caller is the original author of the message. Since write access is the same permission required to post a message, any authenticated user with the
user role and write access to a shared standard channel can modify or permanently delete messages sent by other participants. This allows an attacker to forge content under another user's name or destroy channel history. This issue occurs when the ENABLE CHANNELS setting is enabled by an administrator.Technical details include the following affected API endpoints:
- 'POST /api/v1/channels/{id}/messages/{message id}/update' via the
update message by id()function - 'DELETE /api/v1/channels/{id}/messages/{message id}/delete' via the
delete message by id()function
Recommendations
Update Open WebUI to version 0.11.0.
Exploit
Fix
Missing Authorization
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Open-Webui