{"vulnerability": "cve-2026-7049", "sightings": [{"uuid": "0afacd79-d74d-4ff0-b4c7-0cedd8c9e148", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70494", "type": "seen", "source": "https://gist.github.com/alon710/e57220ec033758e1c7ba8d20ade18b9d", "content": "# CVE-2026-70494: CVE-2026-70494: Broken Access Control in Open WebUI Folder Deletion Endpoint\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70494\n\n## Summary\nA critical broken access control vulnerability in Open WebUI (v0.10.0 to v0.11.0) allows authenticated write-collaborators to delete shared subfolders they do not own. Because deletion triggers a backend cascade using the folder owner's identity, this results in unauthorized permanent deletion of the owner's nested chats, messages, and files.\n\n## TL;DR\nAuthenticated collaborators with write access to a shared folder can delete subfolders owned by others, triggering a cascading deletion of the folder owner's private chat history.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization) / CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network (Remote)\n- **CVSS v3.1 Score**: 8.1 (High)\n- **EPSS Score**: Not Available\n- **Impact**: Data Destruction / Loss of Chat History\n- **Exploit Status**: POC-Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Open WebUI self-hosted AI platform\n- **Open WebUI**: >= v0.10.0, < v0.11.0 (Fixed in: `v0.11.0`)\n\n## Mitigation\n\n- Upgrade Open WebUI to version v0.11.0 or later.\n- Manually patch backend/open_webui/routers/folders.py to restrict subfolder deletion to owners and administrators.\n\n**Remediation Steps:**\n1. Pull the latest Docker image or release package for Open WebUI v0.11.0.\n2. Restart the application container.\n3. Verify that folder deletion requests from non-owners without admin privileges return a 403 Forbidden status code.\n\n## References\n\n- [CVE-2026-70494 Record](https://www.cve.org/CVERecord?id=CVE-2026-70494)\n- [GHSA-3cg5-48j3-v4gv Security Advisory](https://github.com/open-webui/open-webui/security/advisories/GHSA-3cg5-48j3-v4gv)\n- [Pull Request #27003](https://github.com/open-webui/open-webui/pull/27003)\n- [Fix Commit 915ef7d0798d3175819cedbb2f62d7bf0db78c98](https://github.com/open-webui/open-webui/commit/915ef7d0798d3175819cedbb2f62d7bf0db78c98)\n- [Open WebUI v0.11.0 Release](https://github.com/open-webui/open-webui/releases/tag/v0.11.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70494) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T21:31:22.559648Z"}, {"uuid": "f75940be-a6fe-4b3b-843b-285f0dbff041", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70492", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bzto3ybcv52fo", "content": "CVE-2026-70492 - Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages\nCVE ID : CVE-2026-70492\n \n Published : Aug. 4, 2026, 9:16 p.m. | 30\u00a0minutes ago\n \n Description : Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI p...", "creation_timestamp": "2026-08-04T21:55:37.437408Z"}, {"uuid": "f3d25416-5a42-4b17-96ac-62c28b72c1fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70494", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4gwhhcjz2ufst", "content": "CVE-2026-70494 - Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder\nCVE ID : CVE-2026-70494\n \n Published : Aug. 4, 2026, 9:16 p.m. | 30\u00a0minutes ago\n \n Description : Open WebUI is an extensible, feature-rich, and user...", "creation_timestamp": "2026-08-04T22:01:37.275408Z"}, {"uuid": "47d37e52-a172-4777-954c-8cb3d99dbe5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70493", "type": "published-proof-of-concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-2f54-p244-32q6", "content": "", "creation_timestamp": "2026-08-04T22:35:03.740033Z"}, {"uuid": "be62a70b-b48c-4a7c-82a8-5548e4de96ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70492", "type": "published-proof-of-concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-pwxh-7358-jq2x", "content": "", "creation_timestamp": "2026-08-04T22:35:08.196411Z"}, {"uuid": "d3d2796d-abd0-445a-9424-ef1ca020cdf4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70491", "type": "published-proof-of-concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3r7g-q6cg-q2vx", "content": "", "creation_timestamp": "2026-08-04T22:35:12.608368Z"}, {"uuid": "3a9050fb-7fef-4769-a0fd-fe10d3e933aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7049", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3ml7abbghlf2g", "content": "CVE-2026-7049 pixelyoursite-pro (CVSS Score 7.2) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-06T17:33:06.804099Z"}, {"uuid": "20db158e-1072-47c3-abf7-ea2964c15c95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70493", "type": "seen", "source": "https://gist.github.com/alon710/2d05301b2f45169422f4602c106418b3", "content": "# CVE-2026-70493: CVE-2026-70493: Regular Expression Denial of Service (ReDoS) in Open WebUI Knowledge Search\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70493\n\n## Summary\nCVE-2026-70493 is a critical Regular Expression Denial of Service (ReDoS) vulnerability affecting Open WebUI from version 0.9.6 up to (but excluding) 0.11.0. An authenticated user can submit a custom, highly complex regular expression pattern to search files within the knowledge base. Because these expressions are compiled and executed synchronously using Python's standard backtracking re module inside an asynchronous event loop, the server becomes unresponsive. A single request is capable of stalling the entire platform, denying access to all concurrent users of the system.\n\n## TL;DR\nAuthenticated users can submit complex regular expressions to search knowledge base files, triggering thread-blocking exponential backtracking that completely stalls the single-threaded Uvicorn worker of Open WebUI, causing a complete denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333 (Inefficient Regular Expression Complexity)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5 (Medium)\n- **EPSS Score**: Not Available\n- **Impact**: Denial of Service (DoS) via thread blocking\n- **Exploit Status**: Proof-of-Concept Verified\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Open WebUI backend application server running on Python ASGI/Uvicorn environments\n- **open-webui**: >= 0.9.6, < 0.11.0 (Fixed in: `0.11.0`)\n\n## Mitigation\n\n- Upgrade Open WebUI to version 0.11.0 or newer to replace standard Python re with the timeout-enabled regex engine.\n- Deploy Open WebUI with multiple Uvicorn workers by setting UVICORN_WORKERS environment variable to at least 2 or 4.\n- Implement a reverse proxy or Web Application Firewall (WAF) to block or sanitize complex regex inputs within API chat routes.\n- Limit concurrent request rates for authenticated endpoints to prevent parallel request amplification attacks.\n\n**Remediation Steps:**\n1. Stop the running Open WebUI container or server process.\n2. Update your installation configuration, Dockerfile, or docker-compose file to fetch open-webui version >= 0.11.0.\n3. Set the environment variable UVICORN_WORKERS=4 to ensure high availability across multi-threaded operations.\n4. Restart the Open WebUI container and verify that the requirements.txt utilizes regex==2026.5.9.\n5. Perform a validation check using a standard test pattern to confirm timeouts trigger correctly when execution times are exceeded.\n\n## References\n\n- [Open WebUI GitHub Security Advisory](https://github.com/open-webui/open-webui/security/advisories/GHSA-2f54-p244-32q6)\n- [Vulnerability Fix Commit](https://github.com/open-webui/open-webui/commit/3ab2026262ef6f09810e4d235c5f9a9cb903e595)\n- [Vulnerability Fix Pull Request](https://github.com/open-webui/open-webui/pull/27471)\n- [Open WebUI v0.11.0 Release Notes](https://github.com/open-webui/open-webui/releases/tag/v0.11.0)\n- [CVE-2026-70493 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-70493)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70493) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T12:32:01.154828Z"}, {"uuid": "e0e08d51-b01d-460d-b402-47abdd85e002", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70492", "type": "seen", "source": "https://gist.github.com/alon710/63aaf77a9f4550ada3647ec00940f1b7", "content": "# CVE-2026-70492: CVE-2026-70492: Stored Cross-Site Scripting (XSS) via Unescaped KaTeX Render-Error Fallback in Open WebUI\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70492\n\n## Summary\nCVE-2026-70492 (also tracked as GHSA-pwxh-7358-jq2x) is a stored Cross-Site Scripting (XSS) vulnerability in Open WebUI versions 0.10.0 through 0.10.x. The flaw arises because engine-level JavaScript stack overflow errors escape KaTeX standard error handling. Svelte's fallback rendering path assigns the raw, unescaped mathematical input string directly to the DOM using the unsafe {@html} directive, enabling arbitrary client-side code execution. This allows attackers to steal session tokens and perform unauthorized administrative actions when users view malicious messages. The vulnerability has been fully resolved in version 0.11.0.\n\n## TL;DR\nA stored XSS vulnerability in Open WebUI (v0.10.0 to <0.11.0) allows authenticated attackers to execute arbitrary JavaScript in user sessions by forcing a call stack limit error in KaTeX, bypassing error handling and triggering an unescaped HTML fallback rendering path.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.7 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Class**: Stored Cross-Site Scripting (XSS)\n\n## Affected Systems\n\n- Open WebUI\n- **open-webui**: >= 0.10.0, < 0.11.0 (Fixed in: `0.11.0`)\n\n## Mitigation\n\n- Upgrade Open WebUI to version 0.11.0 or higher.\n- Implement Web Application Firewall (WAF) rules to inspect and block inputs with excessively nested structures in mathematical blocks.\n- Manually escape HTML input in Svelte rendering fallback logic if immediate patching is unavailable.\n\n**Remediation Steps:**\n1. Check the current Open WebUI version through the administration panel or via the deployed container image tag.\n2. Obtain the updated release package or container image corresponding to version 0.11.0 or higher.\n3. Rebuild or redeploy the application service to apply the updated KatexRenderer component configurations.\n4. Audit chat and channel database records for historical payloads containing nested braces paired with HTML event triggers.\n\n## References\n\n- [GitHub Advisory GHSA-pwxh-7358-jq2x](https://github.com/open-webui/open-webui/security/advisories/GHSA-pwxh-7358-jq2x)\n- [GitHub Pull Request #26718](https://github.com/open-webui/open-webui/pull/26718)\n- [GitHub Security Fix Commit](https://github.com/open-webui/open-webui/commit/bc600d3f085802c45aa8f38c30e6e8c986bde6cc)\n- [Open WebUI v0.11.0 Release Changelog](https://github.com/open-webui/open-webui/releases/tag/v0.11.0)\n- [CVE-2026-70492 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-70492)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70492) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T13:31:17.824768Z"}, {"uuid": "6399e5d6-b8ad-4a46-b336-014f2a05199d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70491", "type": "seen", "source": "https://gist.github.com/alon710/33c3bff7f99aec7fdcddc66966d519a0", "content": "# CVE-2026-70491: CVE-2026-70491: Source Code Disclosure in Open WebUI Custom Tools\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70491\n\n## Summary\nAn information disclosure vulnerability in Open WebUI versions 0.10.2 and earlier allows authenticated non-admin users with read-only access (or any authenticated user when a tool is shared publicly) to retrieve the raw Python source code of custom workspace tools. Because these server-side tools commonly contain hardcoded API tokens, credentials, and proprietary logic, the exposure of raw tool source code severely compromises confidentiality and can facilitate wider infrastructure compromise.\n\n## TL;DR\nOpen WebUI versions <= 0.10.2 fail to strip sensitive tool source code during serialization due to a permissive Pydantic schema subclass and a non-functional database column defer flag, exposing credentials to unprivileged users.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 6.5\n- **EPSS Score**: Not Available\n- **Impact**: High Confidentiality Loss\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Open WebUI\n- open-webui PyPI Package\n- **Open WebUI**: <= 0.10.2 (Fixed in: `0.11.0`)\n\n## Mitigation\n\n- Upgrade the Open WebUI deployment to version 0.11.0 or later immediately.\n- Disable custom plugin execution by setting ENABLE_PLUGINS to false in environments where custom tools are unnecessary.\n- Enforce strict access control policies on custom tools, avoiding wildcards such as sharing with everyone ('*').\n- Refactor custom tool code to fetch credentials dynamically from environment variables instead of hardcoding values inside the Python script.\n\n**Remediation Steps:**\n1. Determine the current running version of Open WebUI.\n2. Pull and deploy the patched image open-webui:0.11.0 or newer.\n3. Verify that standard user accounts cannot retrieve the 'content' block of tools where they do not possess write access.\n4. Audit existing tool records in the database and rotate any API keys or tokens found hardcoded in old scripts.\n\n## References\n\n- [GHSA-3r7g-q6cg-q2vx Security Advisory](https://github.com/open-webui/open-webui/security/advisories/GHSA-3r7g-q6cg-q2vx)\n- [Fix Tool Serialization Code Change](https://github.com/open-webui/open-webui/commit/c05de13b4fca1ac8a17153782b46b3d0aacf491c)\n- [Open WebUI v0.11.0 Release Notes](https://github.com/open-webui/open-webui/releases/tag/v0.11.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70491) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T14:31:53.370108Z"}]}