Deactivated Channel Members Retain Full Access to Group/DM Channels

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.12"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44561"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T20:01:45Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Deactivated Channel Members Retain Full Access to Group/DM Channels\n\n## Affected Component\n\nChannel membership authorization check:\n- `backend/open_webui/models/channels.py` (lines 663-673, `is_user_channel_member`)\n- Used at 15 locations in `backend/open_webui/routers/channels.py`\n\n## Affected Versions\n\nCurrent main branch (commit `6fdd19bf1`) and likely all versions with the group/DM channel feature.\n\n## Description\n\nThe `is_user_channel_member` function checks whether a `ChannelMember` row exists but does not check the `is_active` field. When a user is deactivated from a group or DM channel (removed by the channel owner, or leaves voluntarily), their membership row persists with `is_active=False` and `status=\u0027left\u0027`. Because the authorization check ignores this field, the deactivated user retains full read and write access to the channel via direct API calls.\n\nThe channel correctly disappears from the deactivated user\u0027s channel list (the listing query at `get_channels_by_user_id` properly filters on `is_active`), but all 15 message-level endpoints in the router rely on `is_user_channel_member` for authorization, which does not filter on `is_active`.\n\n```python\n# models/channels.py:663 \u2014 missing is_active check\ndef is_user_channel_member(self, channel_id, user_id, db=None):\n    membership = db.query(ChannelMember).filter(\n        ChannelMember.channel_id == channel_id,\n        ChannelMember.user_id == user_id,\n    ).first()\n    return membership is not None  # True even when is_active=False\n```\n\nCompare with `get_channel_by_id_and_user_id` (line 778) which correctly checks `ChannelMember.is_active.is_(True)`.\n\n## CVSS 3.1 Breakdown\n\n| Metric | Value | Rationale |\n|--------|-------|-----------|\n| Attack Vector | Network (N) | Exploited remotely via API calls |\n| Attack Complexity | Low (L) | No special conditions beyond knowing the channel ID (which the user had as a former member) |\n| Privileges Required | Low (L) | Requires a valid user account and prior channel membership |\n| User Interaction | None (N) | No victim interaction required |\n| Scope | Unchanged (U) | Impact is within the same authorization boundary (the channel) |\n| Confidentiality | Low (L) | Can read messages in a channel the user should no longer access |\n| Integrity | Low (L) | Can post, edit, and delete messages in the channel |\n| Availability | None (N) | No denial of service |\n\n## Attack Scenario\n\n1. User A and User B are members of a private group channel.\n2. The channel owner removes User B (or User B leaves). User B\u0027s membership is set to `is_active=False, status=\u0027left\u0027`.\n3. The channel disappears from User B\u0027s UI \u2014 but User B noted the channel ID while they were a member.\n4. User B calls the API directly:\n   - `GET /api/v1/channels/{channel_id}/messages` \u2014 reads all messages, including those posted after deactivation\n   - `POST /api/v1/channels/{channel_id}/messages/post` \u2014 posts new messages\n   - `POST /api/v1/channels/{channel_id}/messages/{id}/update` \u2014 edits messages\n   - `DELETE /api/v1/channels/{channel_id}/messages/{id}/delete` \u2014 deletes messages\n5. All requests succeed because `is_user_channel_member` returns `True`.\n\n## Impact\n\n- Deactivated users can continue reading all new messages posted after their removal (confidentiality breach)\n- Deactivated users can post, edit, and delete messages (integrity breach)\n- The deactivation mechanism provides a false sense of security \u2014 channel owners believe removed users have lost access\n\n## Preconditions\n\n- Channels feature must be enabled (disabled by default)\n- Attacker must have a valid user account\n- Attacker must have been a member of the channel at some point (and thus knows the channel ID)\n\n## Recommended Fix\n\nAdd `is_active` filtering to `is_user_channel_member`:\n\n```python\ndef is_user_channel_member(self, channel_id, user_id, db=None):\n    membership = db.query(ChannelMember).filter(\n        ChannelMember.channel_id == channel_id,\n        ChannelMember.user_id == user_id,\n        ChannelMember.is_active.is_(True),\n    ).first()\n    return membership is not None\n```\n\nThis aligns it with the existing `get_channel_by_id_and_user_id` method which already applies this filter correctly.",
  "id": "GHSA-hmgr-67hw-j2cq",
  "modified": "2026-05-08T20:01:45Z",
  "published": "2026-05-08T20:01:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-hmgr-67hw-j2cq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels"
}