← volver
CVE-2026-70481mediumCWE-284CWE-862

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.4epss 0.3%
de la publicación al arma0 días
Publicada en NVD4 ago
1ª PoC4 ago
probabilidad de explotación
0.3%top 78% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant message, while group and direct message handlers enforced authorship. This issue is fixed in 0.11.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Productos afectados
open-webui · open-webui
PoCs públicas encontradas1
githubgithub.com/Foxer131/CVE-2026-704810
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.