Record the CNA's commitment to withdraw the three ZDI records

ZDI confirmed on 18 August that it will update the records and reference the dispositions in its own advisories, and asked what should change in the records themselves. Open WebUI asked for the state set to REJECTED, a rejection reason stating the basis rather than the generic boilerplate, and the disposition pages referenced on the records rather than only in the advisories.

The timelines carry those events, and the standing note above them now says the CNA has confirmed it will withdraw rather than that it agreed to annotate. All three still show as PUBLISHED while the change is carried out.

Author: Classic298

docs/security/vendor-dispositions/cve-2026-0765.mdx

@@ -18,7 +18,7 @@ title: "CVE-2026-0765"
 
 ## Timeline
 
-This CVE is formally disputed. The issuing CNA has reviewed Open WebUI's analysis and agreed the record should be annotated as disputed/rejected, but the record has not yet been amended, so the dispute remains open through the CVE Program's process. The assessment below is Open WebUI's position in the meantime.
+This CVE is formally disputed. The issuing CNA has reviewed Open WebUI's analysis, agreed with its disposition, and confirmed it will withdraw the record. The record still shows as PUBLISHED while that change is carried out, so the dispute remains open through the CVE Program's process. The assessment below is Open WebUI's position in the meantime.
 
 | Date | Event |
 | :--- | :--- |
@@ -34,6 +34,9 @@ This CVE is formally disputed. The issuing CNA has reviewed Open WebUI's analysi
 | 2026-08-03 | Open WebUI follows up again. The record is unchanged. |
 | 2026-08-08 | With no further movement from ZDI for over a month, Open WebUI returns to the CVE Program Root and asks it for closure. |
 | 2026-08-14 | With no response to that request either, Open WebUI files a fresh request with the CVE Program for this record, asking it to carry out the update the CNA has already agreed to rather than reopening the dispute itself. |
+| 2026-08-14 | The CVE Program follows up with the issuing CNA, asking whether it still intends to mark the record disputed or rejected. |
+| 2026-08-18 | ZDI confirms it will update the record and reference this page in its advisory. |
+| 2026-08-19 | ZDI asks what should change in the record. Open WebUI asks for the state set to REJECTED, a rejection reason naming the extension system as intended functionality, and this page referenced on the record itself. |
 
 As of 2026-08-14, the issuing CNA has agreed that the record should be annotated as disputed/rejected, but the CVE record still shows as PUBLISHED and has not been amended. The substantive dispute is therefore settled, and what remains outstanding is the record update itself, which Open WebUI has now asked the CVE Program to carry out. This disposition stands as Open WebUI's official assessment.
 

docs/security/vendor-dispositions/cve-2026-0766.mdx

@@ -18,7 +18,7 @@ title: "CVE-2026-0766"
 
 ## Timeline
 
-This CVE is formally disputed. The issuing CNA has reviewed Open WebUI's analysis and agreed the record should be annotated as disputed/rejected, but the record has not yet been amended, so the dispute remains open through the CVE Program's process. The assessment below is Open WebUI's position in the meantime.
+This CVE is formally disputed. The issuing CNA has reviewed Open WebUI's analysis, agreed with its disposition, and confirmed it will withdraw the record. The record still shows as PUBLISHED while that change is carried out, so the dispute remains open through the CVE Program's process. The assessment below is Open WebUI's position in the meantime.
 
 | Date | Event |
 | :--- | :--- |
@@ -34,6 +34,9 @@ This CVE is formally disputed. The issuing CNA has reviewed Open WebUI's analysi
 | 2026-08-03 | Open WebUI follows up again. The record is unchanged. |
 | 2026-08-08 | With no further movement from ZDI for over a month, Open WebUI returns to the CVE Program Root and asks it for closure. |
 | 2026-08-14 | With no response to that request either, Open WebUI files a fresh request with the CVE Program for this record, asking it to carry out the update the CNA has already agreed to rather than reopening the dispute itself. |
+| 2026-08-14 | The CVE Program follows up with the issuing CNA, asking whether it still intends to mark the record disputed or rejected. |
+| 2026-08-18 | ZDI confirms it will update the record and reference this page in its advisory. |
+| 2026-08-19 | ZDI asks what should change in the record. Open WebUI asks for the state set to REJECTED, a rejection reason naming the extension system as intended functionality, and this page referenced on the record itself. |
 
 As of 2026-08-14, the issuing CNA has agreed that the record should be annotated as disputed/rejected, but the CVE record still shows as PUBLISHED and has not been amended. The substantive dispute is therefore settled, and what remains outstanding is the record update itself, which Open WebUI has now asked the CVE Program to carry out. This disposition stands as Open WebUI's official assessment.
 

docs/security/vendor-dispositions/cve-2026-0767.mdx

@@ -31,7 +31,7 @@ Nothing in the record is specific to Open WebUI, and the identical sentence coul
 
 ## Timeline
 
-This CVE is formally disputed. The issuing CNA has reviewed Open WebUI's analysis and agreed the record should be annotated as disputed/rejected, but the record has not yet been amended, so the dispute remains open through the CVE Program's process. The assessment below is Open WebUI's position in the meantime.
+This CVE is formally disputed. The issuing CNA has reviewed Open WebUI's analysis, agreed with its disposition, and confirmed it will withdraw the record. The record still shows as PUBLISHED while that change is carried out, so the dispute remains open through the CVE Program's process. The assessment below is Open WebUI's position in the meantime.
 
 | Date | Event |
 | :--- | :--- |
@@ -47,6 +47,9 @@ This CVE is formally disputed. The issuing CNA has reviewed Open WebUI's analysi
 | 2026-08-03 | Open WebUI follows up again. The record is unchanged. |
 | 2026-08-08 | With no further movement from ZDI for over a month, Open WebUI returns to the CVE Program Root and asks it for closure. |
 | 2026-08-14 | With no response to that request either, Open WebUI files a fresh request with the CVE Program for this record, asking it to carry out the update the CNA has already agreed to rather than reopening the dispute itself. |
+| 2026-08-14 | The CVE Program follows up with the issuing CNA, asking whether it still intends to mark the record disputed or rejected. |
+| 2026-08-18 | ZDI confirms it will update the record and reference this page in its advisory. |
+| 2026-08-19 | ZDI asks what should change in the record. Open WebUI asks for the state set to REJECTED, a rejection reason naming plain HTTP rather than a product defect, and this page referenced on the record itself. |
 
 As of 2026-08-14, the issuing CNA has agreed that the record should be annotated as disputed/rejected, but the CVE record still shows as PUBLISHED and has not been amended. The substantive dispute is therefore settled, and what remains outstanding is the record update itself, which Open WebUI has now asked the CVE Program to carry out. This disposition stands as Open WebUI's official assessment.