GHSA-jgj3-r8hr-9pjw

Suggest an improvement
Source
https://github.com/advisories/GHSA-jgj3-r8hr-9pjw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jgj3-r8hr-9pjw/GHSA-jgj3-r8hr-9pjw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jgj3-r8hr-9pjw
Aliases
  • CVE-2026-44571
Published
2026-05-11T14:05:24Z
Modified
2026-05-11T14:17:09.972666Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission
Details

Vulnerability Description

In standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint

POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only.

When access_control is set to None, the authorization check has_access(..., type="read") evaluates to True, allowing users who are not the message owner to update messages.

As a result, unauthorized modification of other users’ messages is possible.

Attack Prerequisites

  • The attacker is an authenticated user (role user or higher)
  • The target channel is a standard channel (i.e., not group or dm)
  • access_control is None or allows read access
  • The attacker can obtain the target message_id (e.g., via the channel’s message list)

Attack Scenario

  1. The attacker (User B) retrieves another user’s message_id from the message list in a standard channel

  2. The attacker sends a request to

    POST /api/v1/channels/{channel_id}/messages/{message_id}/update

  3. The message authored by another user (User A) is successfully updated

Potential Impact

  • Unauthorized modification of other users’ messages (violation of data integrity)

Steps to Reproduce

  1. Log in as an administrator

<img width="3334" height="1668" alt="image" src="https://github.com/user-attachments/assets/b20323d3-c050-4438-8912-193a417654bc" />

  1. Create User A

<img width="3346" height="788" alt="image" src="https://github.com/user-attachments/assets/b9e4fb8a-b14e-4a4b-b012-02ccfba52fca" />

  1. Create User B

<img width="3354" height="796" alt="image" src="https://github.com/user-attachments/assets/f3cf6892-e6c9-4778-b471-f1cc0deec6c8" />

  1. Log in as User A

<img width="3360" height="1668" alt="image" src="https://github.com/user-attachments/assets/5264ee07-f5c5-4bbe-ad4f-da69fb540fc9" />

  1. Log in as User B

<img width="3354" height="1670" alt="image" src="https://github.com/user-attachments/assets/f112f8e8-b3e2-4e65-b226-c7b6c986f3bb" />

  1. As the administrator, create a new channel

<img width="2582" height="988" alt="image" src="https://github.com/user-attachments/assets/bc012d9a-f884-4c83-b6bb-d1e5399f61bb" />

  1. As User A, post a new message in the channel

<img width="2626" height="962" alt="image" src="https://github.com/user-attachments/assets/d7ff12c2-fe17-44f0-aaf9-5ce2bac9a378" />

  1. As User B, edit User A’s message

<img width="2604" height="958" alt="image" src="https://github.com/user-attachments/assets/8e19ec3e-fdda-4d36-acd5-f3e1fd3402dd" />

  1. Confirm that User A’s message has been modified without authorization

<img width="2378" height="1976" alt="image" src="https://github.com/user-attachments/assets/6415fd41-ac68-4d42-83c9-6297caee1fb4" />

Affected Files and Line Numbers

  • backend/open_webui/routers/channels.py:1417–1460

    The authorization check in update_message_by_id allows access with read permission

  • backend/open_webui/utils/access_control.py:124–135

    When access_control=None and strict=True, read access is permitted

  • backend/open_webui/models/messages.py:341–358

    The update logic does not enforce any message ownership check

Recommended Mitigation

Update the condition in

backend/open_webui/routers/channels.py:1451–1456

by changing the permission check from read to write, so that only administrators, message owners, or users with write permission can update messages.

Proposed Changes

  • For standard channels, change the update permission requirement from

    has_access(..., type="read") to has_access(..., type="write")

  • Preserve the existing ownership check (message.user_id == user.id)

AI Usage

  • Translation from Japanese to English
  • CWE classification and assessment
  • Affected Files and Line Numbers
Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-11T14:05:24Z",
    "cwe_ids": [
        "CWE-862"
    ],
    "severity": "MODERATE",
    "nvd_published_at": null
}
References

Affected packages

PyPI / open-webui

Package

Name
open-webui
View open source insights on deps.dev
Purl
pkg:pypi/open-webui

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.8.6

Affected versions

0.*
0.1.124
0.1.125
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.3.10
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17.dev2
0.3.17.dev3
0.3.17.dev4
0.3.17.dev5
0.3.17
0.3.18
0.3.19
0.3.20
0.3.21
0.3.22
0.3.23
0.3.24
0.3.25
0.3.26
0.3.27.dev1
0.3.27.dev2
0.3.27.dev3
0.3.27
0.3.28
0.3.29
0.3.30.dev1
0.3.30.dev2
0.3.30
0.3.31.dev1
0.3.31
0.3.32
0.3.33.dev1
0.3.33
0.3.34
0.3.35
0.4.0.dev1
0.4.0.dev2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6.dev1
0.4.6
0.4.7
0.4.8
0.5.0.dev1
0.5.0.dev2
0.5.0
0.5.1
0.5.2
0.5.3.dev1
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
0.5.9
0.5.10
0.5.11
0.5.12
0.5.13
0.5.14
0.5.15
0.5.16
0.5.17
0.5.18
0.5.19
0.5.20
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6.dev1
0.6.6
0.6.7
0.6.8
0.6.9
0.6.10
0.6.11
0.6.12
0.6.13
0.6.14
0.6.15
0.6.16
0.6.18
0.6.19
0.6.20
0.6.21
0.6.22
0.6.23
0.6.24
0.6.25
0.6.26.dev1
0.6.26
0.6.27
0.6.28
0.6.29
0.6.30
0.6.31
0.6.32
0.6.33
0.6.34
0.6.35
0.6.36
0.6.37
0.6.38
0.6.39
0.6.40
0.6.41
0.6.42
0.6.43
0.7.0
0.7.1
0.7.2
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jgj3-r8hr-9pjw/GHSA-jgj3-r8hr-9pjw.json"
last_known_affected_version_range 
"<= 0.8.5"