Skip to content
AI Sec Watch
MediumVulnerability

GHSA-jgj3-r8hr-9pjw: Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-44571GHSA-jgj3-r8hr-9pjw
Published
Record updated
View JSON
Affected
  • open-webui <= 0.8.5
Fixed in
0.8.6
  • released March 1, 2026, 71 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.3%

Summary

In standard channels of Open WebUI, the endpoint POST /api/v1/channels/{channel_id}/messages/{message_id}/update checks only read permission. When access_control is None, the has_access(..., type="read") check passes, so any authenticated user who is not the message owner can update other users' messages. The source lists the attacker's prerequisites as an authenticated user with role user or higher, a standard channel, and the ability to obtain the target message_id.

Mitigation

Change the permission check in backend/open_webui/routers/channels.py:1451–1456 from has_access(..., type="read") to has_access(..., type="write") for standard channels, and keep the existing ownership check (message.user_id == user.id).

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

Related items