THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-70487 (MEDIUM 5.3) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew anot

[NVD] CVE-2026-70487 (MEDIUM 5.3) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew anot

lownvdPublished 2026-08-04

CVE-2026-70487 CVSS: 5.3 MEDIUM Published: 2026-08-04T21:16:37.480

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file id could have the builtin knowledge

Indicators of compromise

CVE-2026-70487cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-70487