CVE-2026-70484

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.7.0 through 0.10.0

Description An authenticated user whose features.image generation permission has been revoked can still trigger image generation by sending a feature flag in a chat-completion request. The server fails to re-verify the permission when processing the client-supplied features object in the legacy chat path, treating the flag as user intent rather than an authorization decision. This allows unauthorized users to consume the operator's API credits and provider quota, and write generated files to the operator's storage. The issue occurs when the chat-completions endpoint is used and, for versions 0.10.0 and later, when the params.function calling variable is set to legacy.

Recommendations Update Open WebUI to version 0.11.0. As a temporary mitigation, ensure that the ENABLE IMAGE GENERATION configuration is disabled if strict permission enforcement is required for all users.