CVE-2026-704868.2HighCWE-79

CVE-2026-70486: Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

open-webui

Affected: open-webui · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.4%probability of exploitation in the next 30 days

32nd percentile

050100

Higher than 32% of scored CVEs

8.2HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user with access to a configured terminal server could cause script in a previewed file to run in the Open WebUI origin, read the victim's session token from localStorage, and take over the account, with possible server-side code execution if the victim was an admin or held workspace.functions. This issue is fixed in 0.11.0.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

open-webui · open-webui>= 0.9.0, < 0.11.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Cross-site Scripting
Vendor: open-webui
Published: August 2026
Band: Unlikely (under 1%), August 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-70486 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.