{"action":"Upgrade open-webui to 0.10.0 or later.","affected":[{"fixed":"0.10.0","introduced":"0.9.5"}],"component":"open-webui","cve_ids":["CVE-2026-59714"],"ecosystem":"PyPI","epss":0.00478,"exploited":false,"fixed_versions":["0.10.0"],"ghsa_id":"GHSA-x2ff-v5v8-m75m","id":"tcs_01M5KG36PQCFGXGM6DMVS0EY79","modified_at":"2026-08-04T14:40:35.091930908Z","published_at":"2026-07-24T17:01:07Z","references":["https://osv.dev/vulnerability/GHSA-x2ff-v5v8-m75m","https://github.com/open-webui/open-webui/security/advisories/GHSA-x2ff-v5v8-m75m","https://github.com/open-webui/open-webui/commit/33e4e0dcc43afcca80f9c635d762cdc76c768ba9","https://github.com/open-webui/open-webui/commit/ac3449cac91e62b08a7c28e54fcd044d14dea791","https://github.com/open-webui/open-webui","https://github.com/open-webui/open-webui/releases/tag/v0.10.0"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-x2ff-v5v8-m75m","url":"https://osv.dev/vulnerability/GHSA-x2ff-v5v8-m75m"}],"summary":"Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)"}