{
 "id": "AIR-2026-0046",
 "slug": "cve-2026-70488-open-webui-knowledge-base-sync-cleanup-access",
 "title": "CVE-2026-70488: Open WebUI knowledge base sync cleanup access control vulnerability",
 "summary": "An input validation flaw in Open WebUI allows users to delete directories and file embeddings across different knowledge bases. The vulnerability causes document loss in retrieval results but does not disclose contents.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-08-04",
 "incident_date_precision": "day",
 "first_reported": "2026-08-04",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70488",
   "publisher": "NVD",
   "title": "CVE-2026-70488: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.",
   "published_at": "2026-08-04"
  },
  {
   "url": "https://github.com/advisories/GHSA-jxc9-xmc4-gr23",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-70488: Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup",
   "published_at": "2026-08-04"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-70488",
  "broken_access_control"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}