CVE-2026-70483 open-webui CVE debrief

Who should care

Defenders responsible for Open WebUI deployments should assess exposure and prioritize verification and potential upgrades. This includes reviewing access controls for the DELETE /api/v1/chats/{id} endpoint and monitoring for potential abuse. Security teams and vulnerability management teams should also review the issue and plan for mitigations if necessary.

Why it matters

CVE-2026-70483 is a vulnerability in Open WebUI that could allow authenticated users to abort other users' running tasks. Defenders should verify their version, assess exposure, and prioritize upgrades or compensating controls.

• Potential denial of service for legitimate users' tasks
• Possible impact on AI model response, title generation, or tag generation tasks
• Verification of access controls for the DELETE /api/v1/chats/{id} endpoint is necessary

Technical summary

The vulnerability existed in Open WebUI from version 0.9.6 to 0.11.0, where an authenticated user could send a DELETE request to /api/v1/chats/{id} to abort another user's running tasks, despite the operation being refused and no data being deleted or modified. This issue could impact AI model response, title generation, or tag generation tasks. Defenders should prioritize verifying their Open WebUI version and upgrading to 0.11.0 if necessary, as well as monitoring for potential abuse of the DELETE /api/v1/chats/{id} endpoint.

Defensive priority

Defenders should prioritize verifying their Open WebUI version and upgrading to 0.11.0 if necessary, as well as monitoring for potential abuse of the DELETE /api/v1/chats/{id} endpoint.

Recommended defensive actions

• Verify Open WebUI version and upgrade to 0.11.0 if necessary
• Monitor for potential abuse of the DELETE /api/v1/chats/{id} endpoint
• Review and adjust access controls for the DELETE /api/v1/chats/{id} endpoint
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. GitHub references provide additional context on the fix and affected code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.