CVE-2026-70481

Executive Summary

CVE-2026-70481 is a broken access control vulnerability in Open WebUI, a popular self-hosted AI platform. From version 0.5.0 through 0.11.0, the standard channel message update and delete handlers fail to verify that the caller is the original author of the message, allowing any channel member with write access to edit or permanently delete messages posted by other users. This flaw is rated Medium severity with a CVSS score of 5.4 and is fixed in version 0.11.0. Organizations running affected versions of Open WebUI in collaborative or shared-channel environments should prioritize upgrading, as the vulnerability undermines message integrity and can be exploited by any authenticated low-privileged user.

Technical Analysis

The vulnerability resides in Open WebUI's standard channel messaging handlers. In affected versions (0.5.0 through 0.11.0), the backend endpoints responsible for updating and deleting messages in standard channels perform authorization checks that only verify the caller has write access to the channel — not that they authored the message in question. This is a classic CWE-284 (Improper Access Control) flaw.

The codebase implements different authorization logic for different channel types:

• Standard channels: The update/delete handlers check channel.write_access but omit a check on message.user_id against the authenticated caller's ID.
• Group and direct message (DM) channels: The handlers correctly enforce authorship by comparing message.user_id to the requesting user's ID before allowing modification or deletion.

This inconsistency means that in standard channels — which are typically shared workspaces where multiple members collaborate — any participant who can post messages (i.e., has write access) can also:

1. Edit messages authored by any other member, including injecting malicious content, altering factual records, or replacing legitimate text with phishing links or social engineering payloads.
2. Permanently delete messages authored by others, destroying conversation context, audit trails, and potentially evidence of prior discussions or decisions.

The attack surface is the authenticated web API endpoint for standard channel message operations. The vulnerability requires a valid account with write access to a standard channel, which is the default permission model for non-admin members. No special privileges are required beyond ordinary participation.

The root cause appears to be a missing predicate in the authorization middleware or route handler — likely a missing comparison between the message's user_id field and the authenticated user's ID. This is a common oversight when developers add new channel types (standard channels were introduced as a distinct type from groups/DMs) without replicating all authorization guards.

Exploitation Scenarios

An attacker with a low-privileged account (e.g., a standard channel member) can exploit this flaw string as follows:

Step 1 — Reconnaissance and Target Identification:

1. Authenticate to the Open WebUI instance (e.g., https://target.openwebui.local) with the compromised or legitimate low-privilege account.
2. Enumerate available standard channels via the API: GET /api/v1/channels/standard — identify a target channel containing valuable messages (e.g., a production decision channel, incident discussion, or executive collaboration workspace).
3. List channel messages: GET /api/v1/channels/{channel_id}/messages — review message metadata (IDs, authors, timestamps) to select a high-value target message. Note the message_id field of a message authored by another member, particularly one from an admin or security-critical user.

Step 2 — Weaponization (Message Tampering/Deletion):

4. Edit scenario (integrity compromise): Send a PATCH request to the message update endpoint: PATCH /api/v1/channels/{channel_id}/messages/{target_message_id} with a JSON body containing malicious replacement content (e.g., a phishing URL disguised as a legitimate link, or falsified instructions that trick other members into visiting a credential-harvesting site). The server accepts the request because the caller has write access — no authorship check is performed.
5. Delete scenario (availability compromise): Send a DELETE request to DELETE /api/v1/channels/{channel_id}/messages/{target_message_id}. The message is permanently removed, with no recovery via the standard UI. Critical conversation history, compliance-relevant records, or incident response coordination threads are lost.

Step 3 — Escalation and Post-Exploitation:

6. Repeat the process across multiple standard channels to maximize coverage. An attacker could systematically delete all messages in a channel (except those they authored), rendering the channel useless for collaboration.
7. Combine with the edit primitive to perform social engineering: modify a trusted member's message to contain a malicious link, increasing the likelihood other members click it. This bypasses user suspicion because the message appears to come from a trusted colleague.
8. If the deleted/edited messages were part of an audit or compliance trail, the attacker erases evidence of prior actions, potentially covering other malicious activity on the platform.
9. In a worst-case scenario, the attacker uses the edit function to inject XSS payloads if the Open WebUI frontend fails to sanitize message content — though this depends on the frontend's rendering behavior and is not confirmed by the CVE description.

Impact: The attacker achieves persistent tampering of shared conversation history with a single low-privilege account. No chaining with other vulnerabilities is required; the flaw is directly exploitable via standard authenticated API calls.

Impact Assessment

• CVSS Breakdown: The vulnerability scores 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. Key attributes: network-exploitable (AV:N), low attack complexity (AC:L), requires low-privilege authenticated access (PR:L), no user interaction (UI:N), scope unchanged (S:U), no confidentiality impact (C:N), low integrity impact (I:L), low availability impact (A:L).
• Affected Systems: All Open WebUI deployments running versions 0.5.0 through 0.10.x (fixed in 0.11.0) with standard channels enabled.
• Business Impact:
  • Integrity loss: Critical decisions, audit logs, and compliance records stored in channel messages can be falsified, undermining trust in platform data.
  • Availability loss: Permanent deletion of messages disrupts collaborative workflows, destroys institutional knowledge, and may violate regulatory retention requirements.
  • Social engineering amplifier: Modified messages appear legitimate and originate from trusted colleagues, significantly increasing phishing success rates.
  • Lateral movement: An attacker with even a guest-level channel account can target messages from admins or security teams, potentially extracting sensitive context or redirecting responses.
• Blast Radius: Moderate. The vulnerability requires valid credentials, and the impact is limited to the Open WebUI channel message feature. However, in organizations using Open WebUI as their primary AI collaboration hub (e.g., for security analysis, R&D discussions, or incident management), the loss of message integrity is severe.
• EPSS Context: The EPSS score is 0.00299 (22.2% percentile), indicating a relatively low current probability of exploitation in the wild. However, this likely reflects the recent publication of the CVE and may increase as awareness spreads.
• CISA KEV: Not listed on CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been identified.

Detection Guidance

Sigma Rule

title: Open WebUI - Unauthorized Channel Message Modification or Deletion
id: 7f3a9c2e-5b41-4d8f-a1e6-9c2b8d4f7a01
status: experimental
description: Detects attempts to modify or delete messages in standard channels where the actor may not be the message author (CVE-2026-70481).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-70481
author: vartersit.com Threat Intel Team
date: 2026/01/01
tags:
    - attack.defense_evasion
    - attack.persistence
    - attack.t1070
    - cve.2026.70481
logsource:
    category: application
    product: open_webui
    definition: Requires server-side access or API logs from Open WebUI.
detection:
    selection_edit:
        http.method: PATCH
        http.url|contains:
            - /api/v1/channels/
            - /messages/
    selection_delete:
        http.method: DELETE
        http.url|contains:
            - /api/v1/channels/
            - /messages/
    filter_normal:
        http.response.status_code: 401
    condition: (selection_edit or selection_delete) and not filter_normal
level: medium
falsepositives:
    - Legitimate message edits by the original author.
    - Admin operations or bulk moderation actions.
fields:
    - src_ip
    - user.name
    - http.url
    - http.user_agent
    - channel_id
    - message_id

YARA Rule

rule OpenWebUI_CVE_2026_70481_Message_Tampering
{
    meta:
        author = "vartersit.com Threat Intel Team"
        description = "Detects API requests targeting Open WebUI channel message endpoints without proper authorization context."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-70481"
        date = "2026-01-01"
        cve = "CVE-2026-70481"
        severity = "medium"
    strings:
        $p1 = "/api/v1/channels/" ascii wide
        $p2 = "/messages/" ascii wide
        $p3 = "PATCH" ascii wide
        $p4 = "DELETE" ascii wide
        $p5 = "message_id" ascii wide
        $p6 = "channel_id" ascii wide
        $p7 = "author_id" ascii wide
        $suspicious_content = "user_id" ascii wide
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A and
        filesize < 10KB and
        (
            ($p1 and $p2) and
            ($p3 or $p4) and
            ($p5 and $p6)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Open WebUI Channel Message Unauthorized Modify/Delete Attempt (CVE-2026-70481)"; flow:established,to_server; content:"PATCH"; http_method; content:"/api/v1/channels/"; http_uri; content:"/messages/"; http_uri; content:"message_id"; http_client_body; sid:202670481; rev:1; reference:cve,2026-70481; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-70481; classtype:attempted-user; metadata:created_at 2026_01_01, updated_at 2026_01_01;)
alert http any any -> any any (msg:"ET EXPLOIT Open WebUI Channel Message Unauthorized Delete Attempt (CVE-2026-70481)"; flow:established,to_server; content:"DELETE"; http_method; content:"/api/v1/channels/"; http_uri; content:"/messages/"; http_uri; sid:202670482; rev:1; reference:cve,2026-70481; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-70481; classtype:attempted-user; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip, user.id with maxspan=5m
  [http where request.method == ("PATCH" or "DELETE") and request.url.text like "*api/v1/channels/*/messages/*" and request.url.text like "*/messages/*"]
  [file where event.action in ("delete", "modify")]

Alternative EQL — single event detection:

any where
  event.action in ("request", "http_request") and
  http.request.method in ("PATCH", "DELETE") and
  url.path like "/api/v1/channels/*/messages/*" and
  not url.path like "*/messages/group/*" and
  not url.path like "*/messages/direct/*"

Splunk SPL Query

index=web OR index=proxy sourcetype="openwebui:access" OR sourcetype="openwebui:api"
| where method IN ("PATCH", "DELETE")
| regex uri="/api/v1/channels/[^/]+/messages/[^/]+"
| regex uri!="/api/v1/channels/[^/]+/messages/(group|direct)/"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, user, uri, method, status
| where count > 1
| eval exploit_potential = if(status == 200, "CONFIRMED_MODIFICATION/DELETION", "ATTEMPT")
| table first_seen, last_seen, src_ip, user, uri, method, status, count, exploit_potential
| sort - first_seen

Wazuh OSSEC Rule

<group name="openwebui,">
  <rule id="100481" level="10">
    <if_sid>31100</if_sid>
    <regex>PATCH /api/v1/channels/.*/messages/</regex>
    <description>Open WebUI: PATCH request to channel message endpoint - potential unauthorized edit (CVE-2026-70481)</description>
    <group>attack.defense_evasion,cve_2026_70481,</group>
  </rule>
  <rule id="100482" level="10">
    <if_sid>31100</if_sid>
    <regex>DELETE /api/v1/channels/[^/]+/messages/</regex>
    <description>Open WebUI: DELETE request to channel message endpoint - potential unauthorized deletion (CVE-2026-70481)</description>
    <group>attack.defense_evasion,cve_2026_70481,</group>
  </rule>
</group>

Log collection prerequisite: Wazuh must receive Open WebUI access logs (e.g., from access.log via a custom log decoder, or a WAF log source that includes HTTP method and URI).

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — A single source (NVD) claims a patch exists in version 0.11.0. This has not been independently confirmed by the vendor advisory (Vendor Fix: N/A). Verify the fix directly on the upstream repository before treating the issue as resolved.

1. Immediate Mitigations (until patched):

   • Disable or restrict standard channels: If the environment does not require standard channel message editing, disable the feature or restrict write access to a trusted admin group using Open WebUI's role-based access controls.
   • Restrict network exposure: Place Open WebUI behind a reverse proxy or VPN; restrict access to authenticated users only via IP allowlisting.
   • Monitor aggressively: Enable auditing on the Open WebUI API layer and create alerts for anomalous PATCH/DELETE patterns to standard channel messages, especially where the acting user may not be the message author.
   • Enable redaction logs: Set up database-level backups or archival that preserve message history even after deletion attempts, allowing forensic recovery if tampering occurs.

2. Patch/Upgrade Steps:

   • Upgrade to 0.11.0 or later. Obtain the patched package from the official repository: docker compose pull or pip install open-webui==0.11.0 (check official documentation for your installation method).
   • If using a containerized deployment: docker pull ghcr.io/open-webui/open-webui:main (confirm 0.11.0 image) and recreate the container.
   • After upgrade, verify the fix by testing: as a standard channel member, attempt to edit/delete a message authored by another member. Confirm the request is rejected with an authorization error (HTTP 403).

3. Long-Term Hardening:

   • Adopt least-privilege principles: Review channel membership and restrict write access to only users who genuinely need it. Consider creating separate read-only channels for audit/archive purposes.
   • Implement immutable audit logging: Route Open WebUI channel message activity (including author IDs, timestamps, and content hashes) to an external SIEM or log management platform that provides write-once-read-many storage. This preserves evidence even if the Open WebUI instance is compromised.
   • Periodic security reviews: Re-audit Open WebUI's authorization logic after every major upgrade. Test channel message handlers for other authorization gaps (e.g., IDOR on direct messages, privilege escalation via channel admin role).
   • Monitor for upcoming updates: Since Patch Confidence is only 2/4, track the Open WebUI GitHub repository for a vendor advisory and confirm the fix's completeness. If a patch is not published within a reasonable timeframe, consider isolating the service.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-70481 — Official vulnerability description and CVSS metadata.
2. Open WebUI Repository: https://github.com/open-webui/open-webui — Upstream project; check release notes for version 0.11.0 to confirm the fix.
3. NVD CWE Reference: https://cwe.mitre.org/data/definitions/284.html — CWE-284 Improper Access Control baseline.
4. MITRE ATT&CK — Indicator Removal: https://attack.mitre.org/techniques/T1070/ — Related technique for the deletion-based exploitation aspect.
5. EPSS Data (FIRST.org): https://www.first.org/epss/ — Live EPSS score reference for context on exploit probability.

Known Threat Actor Campaigns: None identified as of the publication date of this report. CISA KEV does not list this CVE, and no exploit-in-the-wild evidence has been published. The EPSS percentile (22.2%) suggests exploitation remains unlikely in the short term, but this assessment should be revisited as the Open WebUI user base grows.