CVE-2026-70481 in Open WebUI
Summary
by MITRE • 08/04/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant message, while group and direct message handlers enforced authorship. This issue is fixed in 0.11.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability affects Open WebUI version 0.5.0 through 0.11.0, where the platform's permission model contained a critical flaw in its message handling logic for standard channels. The security issue stems from improper access control validation during message update and deletion operations, specifically in the channel message handlers that govern how users interact with shared communication spaces. The flaw represents a direct violation of the principle of least privilege, where the system failed to verify that the requesting user was the original author of the message before permitting modification or deletion actions.
The technical nature of this vulnerability lies in the asymmetric permission enforcement across different message types within the platform's messaging architecture. While standard channels implemented a permissive access model that allowed any user with write privileges to modify or delete messages regardless of authorship, group and direct message handlers correctly enforced message ownership requirements. This inconsistency created a scenario where ordinary participants in shared standard channels could execute arbitrary modifications on messages authored by other users, effectively enabling unauthorized message manipulation and potential data integrity compromise.
From an operational security perspective, this vulnerability exposes organizations to significant risks including message tampering, data corruption, and potential information disclosure through the deletion of critical communications. The flaw essentially allows any member with write access to perform unauthorized actions against messages they did not create, which could be exploited for malicious purposes such as removing evidence of conversations or altering communication content to mislead other participants. This represents a serious breach of user trust and platform integrity in collaborative environments where message authenticity is paramount.
The vulnerability aligns with CWE-284 (Improper Access Control) and demonstrates characteristics consistent with ATT&CK technique T1566 (Phishing) through potential abuse of message manipulation for social engineering attacks, or T1499 (Endpoint Tampering) when messages are altered to hide malicious activity. The fix implemented in version 0.11.0 addresses this by enforcing proper authorship validation across all channel types, ensuring that only the original message creators can modify their content. Organizations should immediately upgrade to version 0.11.0 or later, conduct thorough security audits of their existing deployments, and consider implementing additional monitoring for unauthorized message modifications in environments where this vulnerability may have been present. The remediation process should also include reviewing access control policies and ensuring that write privileges are appropriately managed across all shared communication channels to prevent similar issues in other components of the platform's architecture.