CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5366 vulnerabilities reference this CWE, most recent first.
GHSA-FJP2-MHWX-8H8R
Vulnerability from github – Published: 2025-02-07 09:31 – Updated: 2025-02-07 09:31The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via the 'bse-elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created with Elementor that they should not have access to.
{
"affected": [],
"aliases": [
"CVE-2024-13841"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-07T07:15:14Z",
"severity": "MODERATE"
},
"details": "The Builder Shortcode Extras \u2013 WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via the \u0027bse-elementor-template\u0027 shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created with Elementor that they should not have access to.",
"id": "GHSA-fjp2-mhwx-8h8r",
"modified": "2025-02-07T09:31:51Z",
"published": "2025-02-07T09:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13841"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/builder-shortcode-extras/tags/1.0.0/includes/shortcodes/elementor.php#L116"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/642dc1d3-a008-4af8-ba9e-dbdd37b93126?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FM4F-3F67-2HGV
Vulnerability from github – Published: 2026-10-20 18:31 – Updated: 2026-10-20 18:31Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.
{
"affected": [],
"aliases": [
"CVE-2026-113359"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-20T16:17:06Z",
"severity": "MODERATE"
},
"details": "Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.",
"id": "GHSA-fm4f-3f67-2hgv",
"modified": "2026-10-20T18:31:43Z",
"published": "2026-10-20T18:31:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/baserow/baserow/security/advisories/GHSA-r8cf-4rgr-x5cv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113359"
},
{
"type": "WEB",
"url": "https://github.com/baserow/baserow/issues/4870"
},
{
"type": "WEB",
"url": "https://github.com/baserow/baserow/commit/6884c1a49adb5eb0a32de1220e6d9f99e9d97c1f"
},
{
"type": "WEB",
"url": "https://github.com/baserow/baserow/blob/2.2.2/backend/src/baserow/contrib/database/api/fields/views.py"
},
{
"type": "WEB",
"url": "https://github.com/baserow/baserow/releases/tag/2.3.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/baserow-before-2.3.0-cross-workspace-data-disclosure-via-unique-row-values-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FM8W-VW7V-WR8R
Vulnerability from github – Published: 2026-01-22 18:30 – Updated: 2026-01-26 21:30Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.3.
{
"affected": [],
"aliases": [
"CVE-2026-24379"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-22T17:16:40Z",
"severity": "CRITICAL"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through \u003c= 2.4.3.",
"id": "GHSA-fm8w-vw7v-wr8r",
"modified": "2026-01-26T21:30:34Z",
"published": "2026-01-22T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24379"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-4-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FMGJ-XVWQ-2GQQ
Vulnerability from github – Published: 2026-10-29 15:30 – Updated: 2026-10-29 15:30Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
{
"affected": [],
"aliases": [
"CVE-2026-115706"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-29T15:17:17Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.",
"id": "GHSA-fmgj-xvwq-2gqq",
"modified": "2026-10-29T15:30:56Z",
"published": "2026-10-29T15:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115706"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-211/391260"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FMGM-GH7C-HWV2
Vulnerability from github – Published: 2026-08-13 00:31 – Updated: 2026-08-13 18:31The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.
{
"affected": [],
"aliases": [
"CVE-2026-18749"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-12T22:17:14Z",
"severity": "CRITICAL"
},
"details": "The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid \u2014 leaks not-yet-released coordinator material to vendors on the case.",
"id": "GHSA-fmgm-gh7c-hwv2",
"modified": "2026-08-13T18:31:26Z",
"published": "2026-08-13T00:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18749"
},
{
"type": "WEB",
"url": "https://github.com/CERTCC/VINCE/pull/235"
},
{
"type": "WEB",
"url": "https://github.com/CERTCC/VINCE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FMM2-VV76-H6WG
Vulnerability from github – Published: 2026-08-12 06:30 – Updated: 2026-08-13 18:31The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.
{
"affected": [],
"aliases": [
"CVE-2026-14857"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-12T06:17:31Z",
"severity": "MODERATE"
},
"details": "The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users\u0027 campaigns.",
"id": "GHSA-fmm2-vv76-h6wg",
"modified": "2026-08-13T18:31:23Z",
"published": "2026-08-12T06:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14857"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/2bd55d2f-2bcc-4c55-94cb-b6df929a7a3a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FMMR-Q3XV-R2HC
Vulnerability from github – Published: 2026-10-12 21:31 – Updated: 2026-10-12 21:31Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callbacks that Scheduler V2 attaches to the Workflows it starts. In affected releases, any authenticated caller could attach a callback with that address to a Workflow start request, the address was exempt from the component.callbacks.allowedAddresses allowlist, and the History service delivered the callback to the component its token named, in whatever namespace that was, without authorizing the original caller there. When the forged completion matches an action a target schedule is running, the schedule records the action as completed while its Workflow still runs, which can defeat an overlap policy such as SKIP, and passes caller-controlled data to the next scheduled Workflow as its last completion result. A forged failure may also pause a schedule configured to pause on failure. A forgery requires the target namespace identifier, the schedule identifier, and the identity and timing of a running action. No disclosure of Workflow payloads or history was identified. Only namespaces that hold Scheduler V2 schedules can be targeted; Scheduler V2 is off by default, and existing Scheduler V2 schedules remain targets after the settings that create them are turned off.
{
"affected": [],
"aliases": [
"CVE-2026-89140"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-12T19:16:40Z",
"severity": "MODERATE"
},
"details": "Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callbacks that Scheduler V2 attaches to the Workflows it starts. In affected releases, any authenticated caller could attach a callback with that address to a Workflow start request, the address was exempt from the component.callbacks.allowedAddresses allowlist, and the History service delivered the callback to the component its token named, in whatever namespace that was, without authorizing the original caller there. When the forged completion matches an action a target schedule is running, the schedule records the action as completed while its Workflow still runs, which can defeat an overlap policy such as SKIP, and passes caller-controlled data to the next scheduled Workflow as its last completion result. A forged failure may also pause a schedule configured to pause on failure. A forgery requires the target namespace identifier, the schedule identifier, and the identity and timing of a running action. No disclosure of Workflow payloads or history was identified. Only namespaces that hold Scheduler V2 schedules can be targeted; Scheduler V2 is off by default, and existing Scheduler V2 schedules remain targets after the settings that create them are turned off.",
"id": "GHSA-fmmr-q3xv-r2hc",
"modified": "2026-10-12T21:31:55Z",
"published": "2026-10-12T21:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89140"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/pull/11876"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/pull/12318"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/pull/12319"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/pull/12320"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/pull/12382"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/commit/a210eeb8c2cc7e22338bb4f552ff1171d8f35969"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/commit/d0bd72e85014f31ecfbada1b436b08806496dbef"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.8"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.4"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/releases/tag/v1.32.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FMP5-4W5P-WX24
Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-03-16 15:30Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable files due to improper file permissions granting full access to the Everyone group. Attackers can replace the nssm_x64.exe binary in the manager and engine service directories with malicious executables to execute code with LocalSystem privileges when services restart.
{
"affected": [],
"aliases": [
"CVE-2016-20033"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-16T14:17:50Z",
"severity": "HIGH"
},
"details": "Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable files due to improper file permissions granting full access to the Everyone group. Attackers can replace the nssm_x64.exe binary in the manager and engine service directories with malicious executables to execute code with LocalSystem privileges when services restart.",
"id": "GHSA-fmp5-4w5p-wx24",
"modified": "2026-03-16T15:30:40Z",
"published": "2026-03-16T15:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-20033"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/40132"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/wowza-streaming-engine-local-privilege-escalation-via-nssm-x64-exe"
},
{
"type": "WEB",
"url": "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5339.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FMQH-XP37-5HR8
Vulnerability from github – Published: 2026-09-10 15:10 – Updated: 2026-09-10 15:10Summary
Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked that the caller actually wrote the message being edited. The message kept its original author, so the replacement text was displayed and stored as though the victim had written it. The dedicated channel message edit route performed the authorship check correctly and refused the same edit, so the two paths disagreed about who may modify a message.
Preconditions
- Channels must be enabled.
ENABLE_CHANNELSdefaults toFalse, so a default deployment is not affected until an administrator turns channels on. - The attacker must be an approved user holding write access to the target channel, which is the ordinary state for any participant. No elevated role, group membership or additional permission is needed, and the attacker does not need to be the channel owner.
- The attacker must know the id of the targeted message. That id is returned to every member who reads the channel, so it requires no further access.
- Channels the attacker cannot post to are not affected, and neither are deployments with channels disabled.
Impact
An attacker can rewrite what another member said, under that member's name, in a shared channel. The stored record and every later reader show the victim as the author of text they never wrote, so this is a loss of both integrity and non-repudiation: the victim cannot point to the record to show what they actually said. A conversation can be silently altered after the fact rather than only appended to.
How much control the attacker has over the replacement text depends on the configured model, because the text is produced by generating a completion into the victim's message. Reducing a message to unrelated or empty content works regardless of the model, while reproducing an exact attacker-chosen string requires a model that returns the supplied prompt closely enough. The attack grants no new role or permission, does not reach channels the attacker cannot already post to, and exposes no message content they could not already read.
Fix
Fixed in 0.11.1 by commit 7d392bedc (#28631). The gate on the channel branch now also compares the targeted message's author against the calling user and refuses when they differ, which is the condition the dedicated channel message update route already applied. Administrators retain the ability to edit any message, on both paths, as before. Upgrading to 0.11.1 fully resolves this, and no configuration change is required.
Root cause
Affected components: - the channel branch of the chat completions handler, which resolves a client-supplied message id for editing - the channel event emitter, which re-checks the message before persisting the update
Not affected: the dedicated channel message update route, which already held the correct check.
The channel branch was written to answer the question of whether the caller may write into this channel and whether the message belongs to it. Both of those checks were present and effective. The question it never asked was whether the caller wrote the message. Ownership of a channel message is carried by the message record rather than by the channel, so channel-level write access was treated as sufficient authority over every message inside it. The dedicated edit route grew the authorship comparison because editing is its only purpose, while the completions path reached the same operation through a general-purpose entry point and inherited only the coarser channel check.
Proof of concept
Reproduced against a running instance built from the development branch, with channels enabled and an OpenAI-compatible upstream that echoes the submitted prompt so the replacement text is deterministic.
Setup, entirely through the ordinary API: an administrator creates two further accounts, Alice and Mallory, both with the plain user role and no additional permissions, creates a channel, and grants both accounts read and write access. Alice posts a message reading ALICE ORIGINAL MESSAGE. Nothing is written directly to the database.
Control, through the dedicated route:
POST /api/v1/channels/<channel_id>/messages/<alice_message_id>/update
Authorization: Bearer <mallory_token>
{"content": "PWNED_BY_MALLORY"}
-> 403
Attack, submitting the same target id to the completions endpoint:
POST /api/chat/completions
Authorization: Bearer <mallory_token>
{"model": "<model>", "stream": true,
"chat_id": "channel:<channel_id>",
"id": "<alice_message_id>",
"messages": [{"role": "user", "content": "PWNED_BY_MALLORY"}]}
-> 200
Reading the channel back afterwards shows the targeted message content replaced with the attacker's string while its recorded author is still Alice.
Credits
- @Classic298 — identified that the completions path and the dedicated edit route disagreed on message authorship, and reproduced the cross-member overwrite end to end.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.5"
},
{
"fixed": "0.11.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-87994"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-10T15:10:29Z",
"nvd_published_at": "2026-09-09T22:18:47Z",
"severity": "MODERATE"
},
"details": "## Summary\nAny member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked that the caller actually wrote the message being edited. The message kept its original author, so the replacement text was displayed and stored as though the victim had written it. The dedicated channel message edit route performed the authorship check correctly and refused the same edit, so the two paths disagreed about who may modify a message.\n\n## Preconditions\n- Channels must be enabled. `ENABLE_CHANNELS` defaults to `False`, so a default deployment is not affected until an administrator turns channels on.\n- The attacker must be an approved user holding write access to the target channel, which is the ordinary state for any participant. No elevated role, group membership or additional permission is needed, and the attacker does not need to be the channel owner.\n- The attacker must know the id of the targeted message. That id is returned to every member who reads the channel, so it requires no further access.\n- Channels the attacker cannot post to are not affected, and neither are deployments with channels disabled.\n\n## Impact\nAn attacker can rewrite what another member said, under that member\u0027s name, in a shared channel. The stored record and every later reader show the victim as the author of text they never wrote, so this is a loss of both integrity and non-repudiation: the victim cannot point to the record to show what they actually said. A conversation can be silently altered after the fact rather than only appended to.\n\nHow much control the attacker has over the replacement text depends on the configured model, because the text is produced by generating a completion into the victim\u0027s message. Reducing a message to unrelated or empty content works regardless of the model, while reproducing an exact attacker-chosen string requires a model that returns the supplied prompt closely enough. The attack grants no new role or permission, does not reach channels the attacker cannot already post to, and exposes no message content they could not already read.\n\n## Fix\nFixed in 0.11.1 by commit `7d392bedc` (#28631). The gate on the channel branch now also compares the targeted message\u0027s author against the calling user and refuses when they differ, which is the condition the dedicated channel message update route already applied. Administrators retain the ability to edit any message, on both paths, as before. Upgrading to 0.11.1 fully resolves this, and no configuration change is required.\n\n## Root cause\nAffected components:\n- the channel branch of the chat completions handler, which resolves a client-supplied message id for editing\n- the channel event emitter, which re-checks the message before persisting the update\n\nNot affected: the dedicated channel message update route, which already held the correct check.\n\nThe channel branch was written to answer the question of whether the caller may write into this channel and whether the message belongs to it. Both of those checks were present and effective. The question it never asked was whether the caller wrote the message. Ownership of a channel message is carried by the message record rather than by the channel, so channel-level write access was treated as sufficient authority over every message inside it. The dedicated edit route grew the authorship comparison because editing is its only purpose, while the completions path reached the same operation through a general-purpose entry point and inherited only the coarser channel check.\n\n## Proof of concept\nReproduced against a running instance built from the development branch, with channels enabled and an OpenAI-compatible upstream that echoes the submitted prompt so the replacement text is deterministic.\n\nSetup, entirely through the ordinary API: an administrator creates two further accounts, Alice and Mallory, both with the plain user role and no additional permissions, creates a channel, and grants both accounts read and write access. Alice posts a message reading `ALICE ORIGINAL MESSAGE`. Nothing is written directly to the database.\n\nControl, through the dedicated route:\n\n```\nPOST /api/v1/channels/\u003cchannel_id\u003e/messages/\u003calice_message_id\u003e/update\nAuthorization: Bearer \u003cmallory_token\u003e\n{\"content\": \"PWNED_BY_MALLORY\"}\n-\u003e 403\n```\n\nAttack, submitting the same target id to the completions endpoint:\n\n```\nPOST /api/chat/completions\nAuthorization: Bearer \u003cmallory_token\u003e\n{\"model\": \"\u003cmodel\u003e\", \"stream\": true,\n \"chat_id\": \"channel:\u003cchannel_id\u003e\",\n \"id\": \"\u003calice_message_id\u003e\",\n \"messages\": [{\"role\": \"user\", \"content\": \"PWNED_BY_MALLORY\"}]}\n-\u003e 200\n```\n\nReading the channel back afterwards shows the targeted message content replaced with the attacker\u0027s string while its recorded author is still Alice.\n\n## Credits\n- **@Classic298** \u2014 identified that the completions path and the dedicated edit route disagreed on message authorship, and reproduced the cross-member overwrite end to end.",
"id": "GHSA-fmqh-xp37-5hr8",
"modified": "2026-09-10T15:10:29Z",
"published": "2026-09-10T15:10:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fmqh-xp37-5hr8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87994"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/pull/28631"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/commit/7d392bedc9c1aaecc94509a58e59186b614433dc"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI: Channel members can overwrite another member\u0027s message via the chat completions endpoint"
}
GHSA-FMRC-XMVQ-7V6Q
Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-09 03:30Tanium addressed an improper access controls vulnerability in Comply.
{
"affected": [],
"aliases": [
"CVE-2026-87033"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T03:17:25Z",
"severity": "MODERATE"
},
"details": "Tanium addressed an improper access controls vulnerability in Comply.",
"id": "GHSA-fmrc-xmvq-7v6q",
"modified": "2026-09-09T03:30:47Z",
"published": "2026-09-09T03:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87033"
},
{
"type": "WEB",
"url": "https://security.tanium.com/TAN-2026-039"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.