CVE-2026-70483

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat-s in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user-s chat id could abort that user-s running model response, title generation, or tag generation, even though the delete was refused and no chat data was deleted, modified, or disclosed. This issue is fixed in 0.11.0.