CVE-2026-70484 json
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
published 2026-08-04 3 mo ago modified 2026-09-18 52 d ago also EUVD-2026-52889 , GHSA-g423-grf7-98rv , PYSEC-2026-3646
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied image_generation flag and did not re-check the features.image_generation permission that the direct image routes and native function-calling path enforce. An authenticated user whose image-generation permission had been revoked could still consume the operator's configured image provider through chat completions, spending API credits and provider quota and writing generated files to operator storage, without exposing provider credentials or other users' data. This issue is fixed in 0.11.0.
Patch / fix
- pypi open-webui 0.11.0
- openwebui open_webui 0.11.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | open-webui | >=0.7.0, <0.11.0 |
0.11.0 |
Affected products
- open-webui open-webui
Classification
References
-
github.com
/open-webui/open-webui/pull/26703
web, patch, vendor-advisory
-
github.com
/open-webui/open-webui/commit/897d69a35c65f8ab54583bb9ca8dc74eab7bcd29
web, patch
-
github.com
/open-webui/open-webui/security/advisories/GHSA-g423-grf7-98rv
web, patch, vendor-advisory
-
github.com
/open-webui/open-webui/releases/tag/v0.11.0
web, release-notes
-
github.com
/open-webui/open-webui
package
-
pypi.org
/project/open-webui
package
-
github.com
/advisories/GHSA-g423-grf7-98rv
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-70484
advisory
Sources
- CVE List CVE-2026-70484
- GitHub Advisory GHSA-g423-grf7-98rv
- NVD CVE-2026-70484
- OSV PYSEC-2026-3646
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.