Vulnerability-Lookup

PYSEC-2026-3605

Vulnerability from pysec - Published: 2026-08-04 11:34 - Updated: 2026-08-04 13:36

Details

Summary

Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel.

This advisory consolidates two filings of the same flaw: the original single-model form, and a multimodel message_ids variant that survives the partial fix shipped in v0.9.6 (see "Fix status" below).

Details (as introduced in v0.9.5)

When a user submits a chat completion request with a chat_id starting with channel:, three authorization gaps combined in v0.9.5:

Ownership check skipped (main.py): the channel: prefix caused the entire ownership/membership verification block to be skipped, with no channel membership/write check replacing it.

if not chat_id.startswith('local:') and not chat_id.startswith('channel:'):  # temporary/channel chats are not stored
    if is_new_chat:
        ...
    else:
        if not await Chats.is_chat_owner(chat_id, user.id) and user.role != 'admin':
            raise HTTPException(...)

Message ID from user input: id (and each value of the multimodel message_ids map) comes directly from the request body and is passed as message_id to the channel emitter.
Unchecked database write (socket/main.py _make_channel_emitter):

async def _make_channel_emitter(request_info):
    channel_id = request_info['chat_id'].removeprefix('channel:')
    message_id = request_info['message_id']  # user-supplied
    ...
    await Messages.update_message_by_id(message_id, update_form)  # no channel/user authz

Messages.update_message_by_id performs a direct primary-key update with no channel_id/user_id validation.

Fix (shipped in v0.10.0)

v0.9.6 added a channel gate to the channel: branch (PR #24725) that closed the single-model path, but it validated only the first entry of the multimodel message_ids map, leaving the multimodel fan-out exploitable. v0.10.0 closes the remaining gap with two layers:

Request-time per-entry validation (backend/open_webui/main.py): every entry of message_ids is validated against the target channel, not just the first; any entry whose target message does not belong to the channel in chat_id is rejected.
Fail-closed emitter (backend/open_webui/socket/main.py, _make_channel_emitter): before writing, it re-reads the target message and returns without writing unless msg.channel_id matches the channel derived from chat_id. A missing or mismatched message is a no-op, so a write can no longer land in a channel the caller does not target.

PoC

Single-model (fixed in v0.9.6):

curl -X POST http://target:8080/api/chat/completions \
  -H "Authorization: Bearer $USER_JWT" -H "Content-Type: application/json" \
  -d '{
    "model": "llama3", "stream": true,
    "chat_id": "channel:any-channel-uuid-here",
    "id": "target-message-uuid-to-overwrite",
    "messages": [{"role": "user", "content": "Repeat exactly: This message has been tampered with"}]
  }'

Multimodel (still works on v0.9.6):

POST /api/chat/completions
{
  "chat_id": "channel:<attacker_channel_id>",
  "message_ids": {
    "model-a": "<message_id_in_attacker_channel>",
    "model-b": "<victim_channel_message_id>"
  },
  "messages": [{"role": "user", "content": "..."}]
}

The first id passes channel scope validation; the second id is used by the per-model fan-out and overwrites the victim-channel message (with model output, or the provider-error string on a deterministic error). Even a failing model call writes error content to the target message.

Impact

Message integrity destruction: an authenticated user can overwrite a message in a channel they cannot access, regardless of membership. The overwritten message retains the original author attribution while displaying attacker-chosen content (impersonation). Private channels, DM channels, and channels the attacker has no access to are all affected; the REST channel routes correctly return 403 for the same attacker, so the bypass is specific to the chat-completion channel pipeline.

Affected versions

Single-model path: introduced in commit 0037baeb2 (v0.9.5), fixed in v0.9.6 (#24725).
Multimodel message_ids path: present from v0.9.6, fixed in v0.10.0.
Consolidated Affected: >= 0.9.5, < 0.10.0. Patched: >= 0.10.0.

Distinction from existing CVEs

CVE-2026-45385 (GHSA-wwhq-cx22-f7vv) covered IDOR in the REST endpoint POST /channels/{id}/messages/{message_id}/update (routers/channels.py); its fix (commit f5e110f) only touched channels.py. This finding uses a different code path (POST /api/chat/completions with chat_id: "channel:<id>" → main.py → socket/main.py:_make_channel_emitter), untouched by that fix.

Suggested fix

Validate every value in message_ids against the channel (not just the first), rejecting any whose target message does not belong to the channel in chat_id. Additionally, make _make_channel_emitter fail closed: re-check that the target message's channel_id matches the channel before calling Messages.update_message_by_id, treating a missing or mismatched message as an error/no-op.

Consolidation

Per Open WebUI's Report Handling policy this advisory consolidates independent reports of the same chat-completions channel-overwrite flaw:

Single-model cross-channel overwrite via the channel: path: @sfwani (earliest filing).
Multimodel message_ids fan-out variant that bypasses the v0.9.6 first-id-only gate: @DavidCarliez.

One CVE for the consolidated advisory.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Impacted products

Name	purl
open-webui	pkg:pypi/open-webui

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui",
        "purl": "pkg:pypi/open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.5"
            },
            {
              "fixed": "0.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.9.5",
        "0.9.6"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59714",
    "GHSA-x2ff-v5v8-m75m"
  ],
  "details": "## Summary\n\nAny authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a `channel:`-prefixed `chat_id` and a target `message_id`. The `channel:` path routes pipeline output through `_make_channel_emitter`, which writes to the `Messages` table using the caller-supplied `message_id` without binding it to the channel.\n\nThis advisory consolidates two filings of the same flaw: the original single-model form, and a multimodel `message_ids` variant that survives the partial fix shipped in v0.9.6 (see \"Fix status\" below).\n\n## Details (as introduced in v0.9.5)\n\nWhen a user submits a chat completion request with a `chat_id` starting with `channel:`, three authorization gaps combined in v0.9.5:\n\n1. **Ownership check skipped** (`main.py`): the `channel:` prefix caused the entire ownership/membership verification block to be skipped, with no channel membership/write check replacing it.\n\n```python\nif not chat_id.startswith(\u0027local:\u0027) and not chat_id.startswith(\u0027channel:\u0027):  # temporary/channel chats are not stored\n    if is_new_chat:\n        ...\n    else:\n        if not await Chats.is_chat_owner(chat_id, user.id) and user.role != \u0027admin\u0027:\n            raise HTTPException(...)\n```\n\n2. **Message ID from user input**: `id` (and each value of the multimodel `message_ids` map) comes directly from the request body and is passed as `message_id` to the channel emitter.\n\n3. **Unchecked database write** (`socket/main.py` `_make_channel_emitter`):\n\n```python\nasync def _make_channel_emitter(request_info):\n    channel_id = request_info[\u0027chat_id\u0027].removeprefix(\u0027channel:\u0027)\n    message_id = request_info[\u0027message_id\u0027]  # user-supplied\n    ...\n    await Messages.update_message_by_id(message_id, update_form)  # no channel/user authz\n```\n\n`Messages.update_message_by_id` performs a direct primary-key update with no `channel_id`/`user_id` validation.\n\n## Fix (shipped in v0.10.0)\n\nv0.9.6 added a channel gate to the `channel:` branch (PR #24725) that closed the single-model path, but it validated only the first entry of the multimodel `message_ids` map, leaving the multimodel fan-out exploitable. v0.10.0 closes the remaining gap with two layers:\n\n1. **Request-time per-entry validation** (`backend/open_webui/main.py`): every entry of `message_ids` is validated against the target channel, not just the first; any entry whose target message does not belong to the channel in `chat_id` is rejected.\n2. **Fail-closed emitter** (`backend/open_webui/socket/main.py`, `_make_channel_emitter`): before writing, it re-reads the target message and returns without writing unless `msg.channel_id` matches the channel derived from `chat_id`. A missing or mismatched message is a no-op, so a write can no longer land in a channel the caller does not target.\n\n## PoC\n\nSingle-model (fixed in v0.9.6):\n\n```bash\ncurl -X POST http://target:8080/api/chat/completions \\\n  -H \"Authorization: Bearer $USER_JWT\" -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"model\": \"llama3\", \"stream\": true,\n    \"chat_id\": \"channel:any-channel-uuid-here\",\n    \"id\": \"target-message-uuid-to-overwrite\",\n    \"messages\": [{\"role\": \"user\", \"content\": \"Repeat exactly: This message has been tampered with\"}]\n  }\u0027\n```\n\nMultimodel (still works on v0.9.6):\n\n```json\nPOST /api/chat/completions\n{\n  \"chat_id\": \"channel:\u003cattacker_channel_id\u003e\",\n  \"message_ids\": {\n    \"model-a\": \"\u003cmessage_id_in_attacker_channel\u003e\",\n    \"model-b\": \"\u003cvictim_channel_message_id\u003e\"\n  },\n  \"messages\": [{\"role\": \"user\", \"content\": \"...\"}]\n}\n```\n\nThe first id passes channel scope validation; the second id is used by the per-model fan-out and overwrites the victim-channel message (with model output, or the provider-error string on a deterministic error). Even a failing model call writes error content to the target message.\n\n## Impact\n\n**Message integrity destruction:** an authenticated user can overwrite a message in a channel they cannot access, regardless of membership. The overwritten message retains the original author attribution while displaying attacker-chosen content (**impersonation**). Private channels, DM channels, and channels the attacker has no access to are all affected; the REST channel routes correctly return 403 for the same attacker, so the bypass is specific to the chat-completion channel pipeline.\n\n## Affected versions\n\n- Single-model path: introduced in commit `0037baeb2` (v0.9.5), fixed in v0.9.6 (#24725).\n- Multimodel `message_ids` path: present from v0.9.6, fixed in v0.10.0.\n- Consolidated Affected: `\u003e= 0.9.5, \u003c 0.10.0`. Patched: `\u003e= 0.10.0`.\n\n## Distinction from existing CVEs\n\nCVE-2026-45385 (GHSA-wwhq-cx22-f7vv) covered IDOR in the REST endpoint `POST /channels/{id}/messages/{message_id}/update` (`routers/channels.py`); its fix (commit `f5e110f`) only touched `channels.py`. This finding uses a different code path (`POST /api/chat/completions` with `chat_id: \"channel:\u003cid\u003e\"` \u2192 `main.py` \u2192 `socket/main.py:_make_channel_emitter`), untouched by that fix.\n\n## Suggested fix\n\nValidate **every** value in `message_ids` against the channel (not just the first), rejecting any whose target message does not belong to the channel in `chat_id`. Additionally, make `_make_channel_emitter` fail closed: re-check that the target message\u0027s `channel_id` matches the channel before calling `Messages.update_message_by_id`, treating a missing or mismatched message as an error/no-op.\n\n## Consolidation\n\nPer Open WebUI\u0027s Report Handling policy this advisory consolidates independent reports of the same chat-completions channel-overwrite flaw:\n\n- Single-model cross-channel overwrite via the `channel:` path: @sfwani (earliest filing).\n- Multimodel `message_ids` fan-out variant that bypasses the v0.9.6 first-id-only gate: @DavidCarliez.\n\nOne CVE for the consolidated advisory.",
  "id": "PYSEC-2026-3605",
  "modified": "2026-08-04T13:36:27.104777Z",
  "published": "2026-08-04T11:34:42.775708Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-x2ff-v5v8-m75m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/33e4e0dcc43afcca80f9c635d762cdc76c768ba9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/ac3449cac91e62b08a7c28e54fcd044d14dea791"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/open-webui"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-x2ff-v5v8-m75m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59714"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)"
}

CVE-2026-59714 (GCVE-0-2026-59714)

Vulnerability from cvelistv5 – Published: 2026-08-13 19:10 – Updated: 2026-08-14 18:08

Title

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This issue is fixed in version 0.10.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 17:39 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/open-webui/open-webui/security…	x_refsource_CONFIRM
https://github.com/open-webui/open-webui/pull/26385	x_refsource_MISC
https://github.com/open-webui/open-webui/commit/a…	x_refsource_MISC
https://github.com/open-webui/open-webui/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
open-webui	open-webui	Affected: >= 0.9.5, < 0.10.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T17:39:19.896564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T18:08:59.250Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-webui",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.9.5, \u003c 0.10.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This issue is fixed in version 0.10.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T19:10:42.122Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-x2ff-v5v8-m75m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-x2ff-v5v8-m75m"
        },
        {
          "name": "https://github.com/open-webui/open-webui/pull/26385",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-webui/open-webui/pull/26385"
        },
        {
          "name": "https://github.com/open-webui/open-webui/commit/ac3449cac91e62b08a7c28e54fcd044d14dea791",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-webui/open-webui/commit/ac3449cac91e62b08a7c28e54fcd044d14dea791"
        },
        {
          "name": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0"
        }
      ],
      "source": {
        "advisory": "GHSA-x2ff-v5v8-m75m",
        "discovery": "UNKNOWN"
      },
      "title": "Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59714",
    "datePublished": "2026-08-13T19:10:42.122Z",
    "dateReserved": "2026-07-06T15:34:16.916Z",
    "dateUpdated": "2026-08-14T18:08:59.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-X2FF-V5V8-M75M

Vulnerability from github – Published: 2026-07-24 17:01 – Updated: 2026-07-24 17:01

Summary

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Details

Summary

Details (as introduced in v0.9.5)

When a user submits a chat completion request with a chat_id starting with channel:, three authorization gaps combined in v0.9.5:

Ownership check skipped (main.py): the channel: prefix caused the entire ownership/membership verification block to be skipped, with no channel membership/write check replacing it.

if not chat_id.startswith('local:') and not chat_id.startswith('channel:'):  # temporary/channel chats are not stored
    if is_new_chat:
        ...
    else:
        if not await Chats.is_chat_owner(chat_id, user.id) and user.role != 'admin':
            raise HTTPException(...)

Message ID from user input: id (and each value of the multimodel message_ids map) comes directly from the request body and is passed as message_id to the channel emitter.
Unchecked database write (socket/main.py _make_channel_emitter):

async def _make_channel_emitter(request_info):
    channel_id = request_info['chat_id'].removeprefix('channel:')
    message_id = request_info['message_id']  # user-supplied
    ...
    await Messages.update_message_by_id(message_id, update_form)  # no channel/user authz

Messages.update_message_by_id performs a direct primary-key update with no channel_id/user_id validation.

Fix (shipped in v0.10.0)

Request-time per-entry validation (backend/open_webui/main.py): every entry of message_ids is validated against the target channel, not just the first; any entry whose target message does not belong to the channel in chat_id is rejected.
Fail-closed emitter (backend/open_webui/socket/main.py, _make_channel_emitter): before writing, it re-reads the target message and returns without writing unless msg.channel_id matches the channel derived from chat_id. A missing or mismatched message is a no-op, so a write can no longer land in a channel the caller does not target.

PoC

Single-model (fixed in v0.9.6):

curl -X POST http://target:8080/api/chat/completions \
  -H "Authorization: Bearer $USER_JWT" -H "Content-Type: application/json" \
  -d '{
    "model": "llama3", "stream": true,
    "chat_id": "channel:any-channel-uuid-here",
    "id": "target-message-uuid-to-overwrite",
    "messages": [{"role": "user", "content": "Repeat exactly: This message has been tampered with"}]
  }'

Multimodel (still works on v0.9.6):

POST /api/chat/completions
{
  "chat_id": "channel:<attacker_channel_id>",
  "message_ids": {
    "model-a": "<message_id_in_attacker_channel>",
    "model-b": "<victim_channel_message_id>"
  },
  "messages": [{"role": "user", "content": "..."}]
}

Impact

Affected versions

Single-model path: introduced in commit 0037baeb2 (v0.9.5), fixed in v0.9.6 (#24725).
Multimodel message_ids path: present from v0.9.6, fixed in v0.10.0.
Consolidated Affected: >= 0.9.5, < 0.10.0. Patched: >= 0.10.0.

Distinction from existing CVEs

Suggested fix

Consolidation

Per Open WebUI's Report Handling policy this advisory consolidates independent reports of the same chat-completions channel-overwrite flaw:

Single-model cross-channel overwrite via the channel: path: @sfwani (earliest filing).
Multimodel message_ids fan-out variant that bypasses the v0.9.6 first-id-only gate: @DavidCarliez.

One CVE for the consolidated advisory.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.5"
            },
            {
              "fixed": "0.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59714"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T17:01:07Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nAny authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a `channel:`-prefixed `chat_id` and a target `message_id`. The `channel:` path routes pipeline output through `_make_channel_emitter`, which writes to the `Messages` table using the caller-supplied `message_id` without binding it to the channel.\n\nThis advisory consolidates two filings of the same flaw: the original single-model form, and a multimodel `message_ids` variant that survives the partial fix shipped in v0.9.6 (see \"Fix status\" below).\n\n## Details (as introduced in v0.9.5)\n\nWhen a user submits a chat completion request with a `chat_id` starting with `channel:`, three authorization gaps combined in v0.9.5:\n\n1. **Ownership check skipped** (`main.py`): the `channel:` prefix caused the entire ownership/membership verification block to be skipped, with no channel membership/write check replacing it.\n\n```python\nif not chat_id.startswith(\u0027local:\u0027) and not chat_id.startswith(\u0027channel:\u0027):  # temporary/channel chats are not stored\n    if is_new_chat:\n        ...\n    else:\n        if not await Chats.is_chat_owner(chat_id, user.id) and user.role != \u0027admin\u0027:\n            raise HTTPException(...)\n```\n\n2. **Message ID from user input**: `id` (and each value of the multimodel `message_ids` map) comes directly from the request body and is passed as `message_id` to the channel emitter.\n\n3. **Unchecked database write** (`socket/main.py` `_make_channel_emitter`):\n\n```python\nasync def _make_channel_emitter(request_info):\n    channel_id = request_info[\u0027chat_id\u0027].removeprefix(\u0027channel:\u0027)\n    message_id = request_info[\u0027message_id\u0027]  # user-supplied\n    ...\n    await Messages.update_message_by_id(message_id, update_form)  # no channel/user authz\n```\n\n`Messages.update_message_by_id` performs a direct primary-key update with no `channel_id`/`user_id` validation.\n\n## Fix (shipped in v0.10.0)\n\nv0.9.6 added a channel gate to the `channel:` branch (PR #24725) that closed the single-model path, but it validated only the first entry of the multimodel `message_ids` map, leaving the multimodel fan-out exploitable. v0.10.0 closes the remaining gap with two layers:\n\n1. **Request-time per-entry validation** (`backend/open_webui/main.py`): every entry of `message_ids` is validated against the target channel, not just the first; any entry whose target message does not belong to the channel in `chat_id` is rejected.\n2. **Fail-closed emitter** (`backend/open_webui/socket/main.py`, `_make_channel_emitter`): before writing, it re-reads the target message and returns without writing unless `msg.channel_id` matches the channel derived from `chat_id`. A missing or mismatched message is a no-op, so a write can no longer land in a channel the caller does not target.\n\n## PoC\n\nSingle-model (fixed in v0.9.6):\n\n```bash\ncurl -X POST http://target:8080/api/chat/completions \\\n  -H \"Authorization: Bearer $USER_JWT\" -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"model\": \"llama3\", \"stream\": true,\n    \"chat_id\": \"channel:any-channel-uuid-here\",\n    \"id\": \"target-message-uuid-to-overwrite\",\n    \"messages\": [{\"role\": \"user\", \"content\": \"Repeat exactly: This message has been tampered with\"}]\n  }\u0027\n```\n\nMultimodel (still works on v0.9.6):\n\n```json\nPOST /api/chat/completions\n{\n  \"chat_id\": \"channel:\u003cattacker_channel_id\u003e\",\n  \"message_ids\": {\n    \"model-a\": \"\u003cmessage_id_in_attacker_channel\u003e\",\n    \"model-b\": \"\u003cvictim_channel_message_id\u003e\"\n  },\n  \"messages\": [{\"role\": \"user\", \"content\": \"...\"}]\n}\n```\n\nThe first id passes channel scope validation; the second id is used by the per-model fan-out and overwrites the victim-channel message (with model output, or the provider-error string on a deterministic error). Even a failing model call writes error content to the target message.\n\n## Impact\n\n**Message integrity destruction:** an authenticated user can overwrite a message in a channel they cannot access, regardless of membership. The overwritten message retains the original author attribution while displaying attacker-chosen content (**impersonation**). Private channels, DM channels, and channels the attacker has no access to are all affected; the REST channel routes correctly return 403 for the same attacker, so the bypass is specific to the chat-completion channel pipeline.\n\n## Affected versions\n\n- Single-model path: introduced in commit `0037baeb2` (v0.9.5), fixed in v0.9.6 (#24725).\n- Multimodel `message_ids` path: present from v0.9.6, fixed in v0.10.0.\n- Consolidated Affected: `\u003e= 0.9.5, \u003c 0.10.0`. Patched: `\u003e= 0.10.0`.\n\n## Distinction from existing CVEs\n\nCVE-2026-45385 (GHSA-wwhq-cx22-f7vv) covered IDOR in the REST endpoint `POST /channels/{id}/messages/{message_id}/update` (`routers/channels.py`); its fix (commit `f5e110f`) only touched `channels.py`. This finding uses a different code path (`POST /api/chat/completions` with `chat_id: \"channel:\u003cid\u003e\"` \u2192 `main.py` \u2192 `socket/main.py:_make_channel_emitter`), untouched by that fix.\n\n## Suggested fix\n\nValidate **every** value in `message_ids` against the channel (not just the first), rejecting any whose target message does not belong to the channel in `chat_id`. Additionally, make `_make_channel_emitter` fail closed: re-check that the target message\u0027s `channel_id` matches the channel before calling `Messages.update_message_by_id`, treating a missing or mismatched message as an error/no-op.\n\n## Consolidation\n\nPer Open WebUI\u0027s Report Handling policy this advisory consolidates independent reports of the same chat-completions channel-overwrite flaw:\n\n- Single-model cross-channel overwrite via the `channel:` path: @sfwani (earliest filing).\n- Multimodel `message_ids` fan-out variant that bypasses the v0.9.6 first-id-only gate: @DavidCarliez.\n\nOne CVE for the consolidated advisory.",
  "id": "GHSA-x2ff-v5v8-m75m",
  "modified": "2026-07-24T17:01:07Z",
  "published": "2026-07-24T17:01:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-x2ff-v5v8-m75m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/33e4e0dcc43afcca80f9c635d762cdc76c768ba9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/ac3449cac91e62b08a7c28e54fcd044d14dea791"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

PYSEC-2026-3605

Summary

Details (as introduced in v0.9.5)

Fix (shipped in v0.10.0)

PoC

Impact

Affected versions

Distinction from existing CVEs

Suggested fix

Consolidation

CVE-2026-59714 (GCVE-0-2026-59714)

GHSA-X2FF-V5V8-M75M

Summary

Details (as introduced in v0.9.5)

Fix (shipped in v0.10.0)

PoC

Impact

Affected versions

Distinction from existing CVEs

Suggested fix

Consolidation

Tags

Sightings

Nomenclature