Executive brief
Open WebUI, a user interface for AI models, contains a flaw where any logged-in user can interrupt the active chat sessions of other users. By sending a specific request to the chat deletion endpoint, an attacker can stop another user's AI response or title generation mid-process. While the attacker cannot actually delete or view the victim's data, they can repeatedly disrupt the service, requiring the victim to restart their AI requests.
Technical details
A missing authorization vulnerability exists in the `delete_chat_by_id` function within `backend/open_webui/routers/chats.py`. The `DELETE /api/v1/chats/{id}` endpoint was designed to cancel active tasks as a cleanup step before deletion, but this cancellation logic was executed before verifying if the requester owned the chat or had administrative privileges. An authenticated attacker who knows or guesses a victim's chat ID can trigger this endpoint to abort running model responses or background tasks. While the actual deletion is blocked by subsequent permission checks, the side effect of task cancellation occurs regardless of ownership. This issue is fixed in version 0.11.0 by reordering the authorization checks.
Affected products
- Open WebUI open-webui >= 0.9.6, < 0.11.0
Timeline
- 2026-08-02: advisory: Initial GitHub Advisory published
- 2026-08-04: patched: Fix released in version 0.11.0