Foxer131/CVE-2026-70481

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains two Python scripts that exploit CVE-2026-70481 in Open WebUI by making API calls to edit, pin, and delete messages authored by other users in a standard channel, bypassing the missing authorship check.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and two Python exploit scripts for CVE-2026-70481. The scripts demonstrate the described vulnerability (unauthorized message edit/delete in Open WebUI) by making API calls to a local test instance. No backdoor, trojan, or deceptive behavior targeting the person running the PoC was observed. The code performs only the advertised exploit actions and contains no concealed executable payloads, persistence mechanisms, credential exfiltration, or unrelated remote access.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareOpen WebUI
Attack typesImproper Access ControlMissing Authorization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The scripts actively exercise the vulnerability by sending crafted HTTP requests to the vulnerable endpoints to modify and delete other users' messages, which is the definition of exploit code.

exploit_channel_message_tamper.py:1-7exploit_channel_message_tamper.py:126-131exploit_channel_takeover.py:1-7exploit_channel_takeover.py:112-118

Requirements

  • A running Open WebUI instance version 0.5.0 through 0.10.2 with a standard channel where the attacker has write access.README.md:3README.md:52-53
  • A lab environment set up by running prep/lab_setup.py, which creates the necessary user accounts, channels, and messages.README.md:55exploit_channel_message_tamper.py:94-95
  • Valid credentials for an attacker account with the 'user' role and write access to the target channel.exploit_channel_message_tamper.py:101-102exploit_channel_takeover.py:97-98

Observed behavior

  • Authenticates as a low-privileged user and edits a message authored by another user, changing its content, data, and meta fields while retaining the original author's name.exploit_channel_message_tamper.py:126-129exploit_channel_message_tamper.py:138-142
  • Pins a message authored by another user.exploit_channel_message_tamper.py:130
  • Deletes a message authored by another user.exploit_channel_message_tamper.py:131
  • Reads the full channel history, including messages from other users.exploit_channel_takeover.py:101-104
  • Optionally performs a mass overwrite and deletion of all foreign messages in the channel.exploit_channel_takeover.py:130-147
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Scripts make HTTP requests to a user-supplied or lab-configured Open WebUI instance to edit, pin, and delete messages as a low-privileged user.This is the normal, documented exploit behavior for CVE-2026-70481 and does not constitute a backdoor.exploit_channel_message_tamper.py:126-131exploit_channel_takeover.py:114-118
Target Configuration
The scripts read a lab.json file and accept command-line arguments for target URL, credentials, and channel ID.This is standard PoC configuration; no hardcoded malicious remote endpoint is present.exploit_channel_message_tamper.py:90-97exploit_channel_takeover.py:73-95
Review boundaries

What the analysis did not establish

  • Two files (prep/lab_setup.py and an unlisted file) are omitted from the evidence, so the full lab setup and any additional context are not available.
  • The evidence does not include the actual execution output, only the source code and documentation.
  • The analysis is based solely on the provided text; the code was not executed, and its reliability or safety is not assessed.
  • Two files (prep/lab_setup.py and one unclassified file) were omitted from the text evidence and were not reviewed. The README describes lab_setup.py as an administrator setup script with no attack, and the reviewed scripts do not import or depend on the unclassified file.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1