CVE-2026-70483: Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

DELETE /api/v1/chats/{id} cancelled a chat’s in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user’s chat id could therefore abort that user’s running model response, title generation or tag generation. The deletion itself was still refused, so the only missing control was on the cancellation side effect.