CVE-2026-70494 is a permission model failure in Open WebUI's folder deletion handler. Versions 0.10.0 through 0.11.0 allowed any user with 'write' access to a shared folder to force-remove chats belonging to the folder owner from the folder hierarchy — not by deleting the chats themselves, but by moving them outside the folder's content subtree. This operation bypassed any ownership check on the chat resources, only validating that the requesting user held inherited write permission on the containing folder.
The critical distinction is that 'write' access was implicitly granting custodial deletion authority over content the user did not own. In this system, folder ownership and chat ownership are separate trust domains: a user may legitimately hold write access to a shared research folder without having any authority over the chats stored within it. The DELETE handler failed to model this boundary — it checked whether the requester could modify the folder container, then proceeded to cascade operations through all descendant content regardless of ownership.
The impact extends beyond data loss. AI platform chats are constructed artifacts representing accumulated context built across multiple API calls, each potentially billed. When an attacker force-removes chats from a victim's folder hierarchy, they aren't just deleting records — they're destroying the contextual foundation of ongoing AI interactions that cannot be restored from backup because the context itself was the value.
Before declaring this patched, verify what 0.11.0 actually changed. A narrow fix that only tightens the subfolder check for this specific endpoint leaves the underlying permission inheritance logic intact — other handlers in the router may still thread folder_id to chat ownership without proper ownership validation. Examine whether the codebase now enforces explicit ownership checks for subtree operations (owner/admin required for any operation affecting resources the requester doesn't own), or whether the fix is limited to this single handler.
Audit the router for other endpoints that apply similar permission inheritance logic to hierarchical content. If the permission model doesn't formally distinguish between container modification rights and content custodial rights at the architectural level, parallel vulnerabilities likely exist elsewhere.