Steps to Reproduce

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44571"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-11T14:05:24Z",
    "nvd_published_at": "2026-05-15T22:16:53Z",
    "severity": "MODERATE"
  },
  "details": "## Vulnerability Description\n\nIn standard channels (i.e., channels whose `channel.type` is neither `group` nor `dm`), the endpoint\n\n`POST /api/v1/channels/{channel_id}/messages/{message_id}/update` can be accessed with **read permission only**.\n\nWhen `access_control` is set to `None`, the authorization check `has_access(..., type=\"read\")` evaluates to `True`, allowing users who are **not the message owner** to update messages.\n\nAs a result, unauthorized modification of other users\u2019 messages is possible.\n\n---\n\n## Attack Prerequisites\n\n- The attacker is an authenticated user (role `user` or higher)\n- The target channel is a standard channel (i.e., not `group` or `dm`)\n- `access_control` is `None` or allows `read` access\n- The attacker can obtain the target `message_id` (e.g., via the channel\u2019s message list)\n\n\n\n## Attack Scenario\n\n1. The attacker (User B) retrieves another user\u2019s `message_id` from the message list in a standard channel\n2. The attacker sends a request to\n    \n    `POST /api/v1/channels/{channel_id}/messages/{message_id}/update`\n    \n3. The message authored by another user (User A) is successfully updated\n\n\n\n## Potential Impact\n\n- Unauthorized modification of other users\u2019 messages (violation of data integrity)\n\n\n# Steps to Reproduce\n\n1. Log in as an administrator\n\n\u003cimg width=\"3334\" height=\"1668\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b20323d3-c050-4438-8912-193a417654bc\" /\u003e\n\n\n2. Create User A\n\n\u003cimg width=\"3346\" height=\"788\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b9e4fb8a-b14e-4a4b-b012-02ccfba52fca\" /\u003e\n\n3. Create User B\n\n\u003cimg width=\"3354\" height=\"796\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f3cf6892-e6c9-4778-b471-f1cc0deec6c8\" /\u003e\n\n\n4. Log in as User A\n\n\u003cimg width=\"3360\" height=\"1668\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5264ee07-f5c5-4bbe-ad4f-da69fb540fc9\" /\u003e\n\n\n5. Log in as User B\n\n\u003cimg width=\"3354\" height=\"1670\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f112f8e8-b3e2-4e65-b226-c7b6c986f3bb\" /\u003e\n\n\n6. As the administrator, create a new channel\n\n\u003cimg width=\"2582\" height=\"988\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bc012d9a-f884-4c83-b6bb-d1e5399f61bb\" /\u003e\n\n\n7. As User A, post a new message in the channel\n\n\u003cimg width=\"2626\" height=\"962\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d7ff12c2-fe17-44f0-aaf9-5ce2bac9a378\" /\u003e\n\n\n8. As User B, edit User A\u2019s message\n\n\u003cimg width=\"2604\" height=\"958\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8e19ec3e-fdda-4d36-acd5-f3e1fd3402dd\" /\u003e\n\n\n9. Confirm that User A\u2019s message has been modified without authorization\n\n\u003cimg width=\"2378\" height=\"1976\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6415fd41-ac68-4d42-83c9-6297caee1fb4\" /\u003e\n\n\n## Affected Files and Line Numbers\n\n- `backend/open_webui/routers/channels.py:1417\u20131460`\n    \n    The authorization check in `update_message_by_id` allows access with **read** permission\n    \n- `backend/open_webui/utils/access_control.py:124\u2013135`\n    \n    When `access_control=None` and `strict=True`, **read** access is permitted\n    \n- `backend/open_webui/models/messages.py:341\u2013358`\n    \n    The update logic does not enforce any message ownership check\n    \n\n## Recommended Mitigation\n\nUpdate the condition in\n\n`backend/open_webui/routers/channels.py:1451\u20131456`\n\nby changing the permission check from **`read`** to **`write`**, so that only administrators, message owners, or users with write permission can update messages.\n\n### Proposed Changes\n\n- For standard channels, change the update permission requirement from\n    \n    `has_access(..., type=\"read\")` to `has_access(..., type=\"write\")`\n    \n- Preserve the existing ownership check (`message.user_id == user.id`)\n\n## **AI Usage**\n\n- Translation from Japanese to English\n- CWE classification and assessment\n- Affected Files and Line Numbers",
  "id": "GHSA-jgj3-r8hr-9pjw",
  "modified": "2026-05-19T15:57:52Z",
  "published": "2026-05-11T14:05:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44571"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI\u0027s Improper Authorization in Standard Channels Allows Message Updates with Read Permission"
}