CVE-2026-70483: Open WebUI Auth Bypass Vulnerability

CVE-2026-70483 Overview

Open WebUI is a self-hosted AI platform for interacting with large language models. CVE-2026-70483 describes a missing authorization check [CWE-862] in the chat deletion endpoint. From version 0.9.6 through 0.11.0, the DELETE /api/v1/chats/{id} route cancelled a chat's in-flight tasks before verifying that the caller was permitted to delete that chat.

Any authenticated user who knew another user's chat identifier could abort that user's running model response, title generation, or tag generation. The delete operation itself was still refused, and no chat data was disclosed, modified, or removed. The issue is fixed in Open WebUI 0.11.0.

Critical Impact
Authenticated attackers can disrupt other users' active LLM tasks (streaming responses, title and tag generation) by triggering premature task cancellation on chat IDs they do not own.

Affected Products

Open WebUI versions from 0.9.6 up to (but not including) 0.11.0
Self-hosted deployments exposing the /api/v1/chats/{id} REST endpoint
Multi-user Open WebUI instances where authenticated users share the same backend

Discovery Timeline

2026-08-04 - CVE-2026-70483 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70483

Vulnerability Analysis

The flaw resides in the chat delete handler in backend/open_webui/routers/chats.py. The handler invoked stop_item_tasks(request.app.state.redis, id) as its first action, which cancels any in-flight LLM tasks associated with the chat identifier in Redis. Only after this side effect did the code branch on the caller's role and check chat ownership.

Because task cancellation ran unconditionally, an authenticated non-admin user could send a DELETE request against a chat identifier belonging to another user. The subsequent authorization check would refuse the delete, but the LLM streaming task, title generation task, or tag generation task had already been aborted through the Redis-backed task registry.

The defect maps to [CWE-862: Missing Authorization]. The requester must be authenticated and must know or guess a valid chat identifier, which limits practical exploitation to environments where identifiers can be observed or enumerated.

Root Cause

The root cause is ordering: a security-relevant side effect (cancelling background tasks) was executed before any authorization decision. The endpoint conflated "clean up before delete" with "the caller is allowed to delete," producing an unauthorized state change even when the delete itself failed.

Attack Vector

An authenticated user issues an HTTP DELETE request to /api/v1/chats/{id} where {id} is another user's chat identifier. The server calls stop_item_tasks against the shared Redis task registry, terminating that user's active model response, title generation, or tag generation before returning an authorization error to the caller.

python

# Patched handler in backend/open_webui/routers/chats.py (excerpt)
#   user=Depends(get_verified_user),
#   db: AsyncSession = Depends(get_async_session),
# ):
# -    # Cancel any in-flight LLM tasks (streaming, title/tags generation)
# -    # before deleting the chat to prevent orphaned requests.
# -    await stop_item_tasks(request.app.state.redis, id)
# -
# -    async def delete_internal_children(owner_id: str) -> None:
# -        child_ids = await Chats.get_internal_chat_ids_by_parent_id(id, owner_id)
# -        for child_id in child_ids:
# -            await stop_item_tasks(request.app.state.redis, child_id)
# -            await Chats.delete_chat_by_id_and_user_id(child_id, owner_id)
# -        await stop_item_tasks(request.app.state.redis, id)
# -
# +    # Authorize before any side effect: cancelling a chat's in-flight tasks must
# +    # not be reachable for a chat the caller may not delete.
#     if user.role == 'admin':
#         chat = await Chats.get_chat_by_id(id, db=db)

Source: GitHub commit 4f93c3e. The fix removes the unconditional stop_item_tasks call at the top of the handler and only cancels tasks after the caller's authorization is confirmed.

Detection Methods for CVE-2026-70483

Indicators of Compromise

Application logs showing DELETE /api/v1/chats/{id} requests that return authorization errors (HTTP 401/403) but immediately precede an LLM task termination event for the referenced chat.
Users reporting that in-progress model responses, chat titles, or tags stopped generating without an explanation from the client.
Redis task registry entries for stop_item_tasks invoked against chat identifiers that the requesting user does not own.

Detection Strategies

Correlate DELETE /api/v1/chats/{id} access logs with backend task-cancellation events, and flag cases where the requesting user is not the chat owner.
Alert on repeated DELETE requests from a single authenticated user against multiple chat identifiers, which suggests identifier enumeration.
Baseline normal task-cancellation volume per user and alert on deviations that coincide with denied delete attempts.

Monitoring Recommendations

Ingest Open WebUI application and reverse-proxy logs into a centralized logging pipeline for cross-request correlation.
Track HTTP status distribution for the /api/v1/chats/{id} route and pivot on authenticated users generating high 403 counts.
Monitor Redis for elevated rates of task-stop operations issued shortly after failed delete calls.

How to Mitigate CVE-2026-70483

Immediate Actions Required

Upgrade Open WebUI to version 0.11.0 or later, which enforces authorization before cancelling in-flight tasks.
Audit multi-user Open WebUI deployments for unexpected task-cancellation events attributable to non-owner users.
Restrict network exposure of the Open WebUI API to trusted, authenticated users while patching is scheduled.

Patch Information

The fix is delivered in Open WebUI v0.11.0 via pull request #27006 and commit 4f93c3e. Additional context is available in the GitHub Security Advisory GHSA-3vf6-64vr-3g56.

Workarounds

If upgrading immediately is not possible, limit account creation and require administrator approval so that only trusted users can authenticate against the API.
Place Open WebUI behind a reverse proxy that rate-limits DELETE requests to /api/v1/chats/{id} per authenticated identity.
Rotate or randomize chat identifiers so they cannot be easily guessed or enumerated from client history.

bash

# Upgrade Open WebUI to the fixed release (Docker example)
docker pull ghcr.io/open-webui/open-webui:0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.11.0

# Verify the running version
curl -s http://localhost:3000/api/version