https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:14:30 +0000 https://vulnerability.circl.lu/vuln/cve-2026-70494 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The cascade following the authorization check is bound to the folder owner&#39;s id, but the subfolder check accepted any inherited write grant instead of requiring ownership or administrator status. A collaborator can destroy the owner&#39;s subtree or force-move chats out of it when delete_contents=false. This issue is fixed in 0.11.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The cascade following the authorization check is bound to the folder owner&#39;s id, but the subfolder check accepted any inherited write grant instead of requiring ownership or administrator status. A collaborator can destroy the owner&#39;s subtree or force-move chats out of it when delete_contents=false. This issue is fixed in 0.11.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-70494