https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 19:33:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-348755 EUVD-2026-348755 https://cve.radiocsirt.org/vuln/euvd-2026-348755 https://cve.radiocsirt.org/vuln/fkie_cve-2026-70483 <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat&#39;s in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user&#39;s chat id could abort that user&#39;s running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat&#39;s in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user&#39;s chat id could abort that user&#39;s running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-70483 https://cve.radiocsirt.org/vuln/ghsa-3vf6-64vr-3g56 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary `DELETE /api/v1/chats/{id}` cancelled a chat&#39;s in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user&#39;s chat id could therefore abort that user&#39;s running model response, title generation or tag generation. The deletion itself was still refused, so the only missing control was on the cancellation side effect.</p> <p>## Preconditions Default configuration, no special deployment shape. The attacker needs a normal account with the default `user` role and nothing else: the `chat.delete` permission is not required, and revoking it does not prevent the cancellation. The attacker also needs the victim&#39;s chat id, which is returned by the read-only shared-chat endpoint when a chat or a folder has been shared with them - otherwise enumerating the chat id requires guessing the chat id or brute forcing it, and the victim must have a generation running at that moment.</p> <p>## Impact A user can repeatedly interrupt another user&#39;s generations without any write access to the target chat. Nothing is deleted, modified or disclosed, and the victim can simply regenerate, so the effect is limited to availability of in-flight responses. Because the attacker only needs a chat id, the interruption can be scripted and repeated for as long as the id stays valid.</p> <p>## Fix Fixed in https://github.com/open-webui/open-webui/pull/27006, released in 0.11.0. The handler now resolves and authorizes the chat first and only cancels task…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary `DELETE /api/v1/chats/{id}` cancelled a chat&#39;s in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user&#39;s chat id could therefore abort that user&#39;s running model response, title generation or tag generation. The deletion itself was still refused, so the only missing control was on the cancellation side effect.</p> <p>## Preconditions Default configuration, no special deployment shape. The attacker needs a normal account with the default `user` role and nothing else: the `chat.delete` permission is not required, and revoking it does not prevent the cancellation. The attacker also needs the victim&#39;s chat id, which is returned by the read-only shared-chat endpoint when a chat or a folder has been shared with them - otherwise enumerating the chat id requires guessing the chat id or brute forcing it, and the victim must have a generation running at that moment.</p> <p>## Impact A user can repeatedly interrupt another user&#39;s generations without any write access to the target chat. Nothing is deleted, modified or disclosed, and the victim can simply regenerate, so the effect is limited to availability of in-flight responses. Because the attacker only needs a chat id, the interruption can be scripted and repeated for as long as the id stays valid.</p> <p>## Fix Fixed in https://github.com/open-webui/open-webui/pull/27006, released in 0.11.0. The handler now resolves and authorizes the chat first and only cancels task…</p> https://cve.radiocsirt.org/vuln/ghsa-3vf6-64vr-3g56 https://cve.radiocsirt.org/vuln/pysec-2026-3640 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary `DELETE /api/v1/chats/{id}` cancelled a chat&#39;s in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user&#39;s chat id could therefore abort that user&#39;s running model response, title generation or tag generation. The deletion itself was still refused, so the only missing control was on the cancellation side effect.</p> <p>## Preconditions Default configuration, no special deployment shape. The attacker needs a normal account with the default `user` role and nothing else: the `chat.delete` permission is not required, and revoking it does not prevent the cancellation. The attacker also needs the victim&#39;s chat id, which is returned by the read-only shared-chat endpoint when a chat or a folder has been shared with them - otherwise enumerating the chat id requires guessing the chat id or brute forcing it, and the victim must have a generation running at that moment.</p> <p>## Impact A user can repeatedly interrupt another user&#39;s generations without any write access to the target chat. Nothing is deleted, modified or disclosed, and the victim can simply regenerate, so the effect is limited to availability of in-flight responses. Because the attacker only needs a chat id, the interruption can be scripted and repeated for as long as the id stays valid.</p> <p>## Fix Fixed in https://github.com/open-webui/open-webui/pull/27006, released in 0.11.0. The handler now resolves and authorizes the chat first and only cancels task…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary `DELETE /api/v1/chats/{id}` cancelled a chat&#39;s in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user&#39;s chat id could therefore abort that user&#39;s running model response, title generation or tag generation. The deletion itself was still refused, so the only missing control was on the cancellation side effect.</p> <p>## Preconditions Default configuration, no special deployment shape. The attacker needs a normal account with the default `user` role and nothing else: the `chat.delete` permission is not required, and revoking it does not prevent the cancellation. The attacker also needs the victim&#39;s chat id, which is returned by the read-only shared-chat endpoint when a chat or a folder has been shared with them - otherwise enumerating the chat id requires guessing the chat id or brute forcing it, and the victim must have a generation running at that moment.</p> <p>## Impact A user can repeatedly interrupt another user&#39;s generations without any write access to the target chat. Nothing is deleted, modified or disclosed, and the victim can simply regenerate, so the effect is limited to availability of in-flight responses. Because the attacker only needs a chat id, the interruption can be scripted and repeated for as long as the id stays valid.</p> <p>## Fix Fixed in https://github.com/open-webui/open-webui/pull/27006, released in 0.11.0. The handler now resolves and authorizes the chat first and only cancels task…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3640