PT-2026-64439 · Pypi · Open-Webui

CVE-2026-59714

·

Published

2026-07-24

·

Updated

2026-07-24

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Summary

Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat id and a target message id. The channel: path routes pipeline output through make channel emitter, which writes to the Messages table using the caller-supplied message id without binding it to the channel.
This advisory consolidates two filings of the same flaw: the original single-model form, and a multimodel message ids variant that survives the partial fix shipped in v0.9.6 (see "Fix status" below).

Details (as introduced in v0.9.5)

When a user submits a chat completion request with a chat id starting with channel:, three authorization gaps combined in v0.9.5:
  1. Ownership check skipped (main.py): the channel: prefix caused the entire ownership/membership verification block to be skipped, with no channel membership/write check replacing it.
python
if not chat id.startswith('local:') and not chat id.startswith('channel:'): # temporary/channel chats are not stored
  if is new chat:
    ...
  else:
    if not await Chats.is chat owner(chat id, user.id) and user.role != 'admin':
      raise HTTPException(...)
  1. Message ID from user input: id (and each value of the multimodel message ids map) comes directly from the request body and is passed as message id to the channel emitter.
  2. Unchecked database write (socket/main.py make channel emitter):
python
async def make channel emitter(request info):
  channel id = request info['chat id'].removeprefix('channel:')
  message id = request info['message id'] # user-supplied
  ...
  await Messages.update message by id(message id, update form) # no channel/user authz
Messages.update message by id performs a direct primary-key update with no channel id/user id validation.

Fix (shipped in v0.10.0)

v0.9.6 added a channel gate to the channel: branch (PR #24725) that closed the single-model path, but it validated only the first entry of the multimodel message ids map, leaving the multimodel fan-out exploitable. v0.10.0 closes the remaining gap with two layers:
  1. Request-time per-entry validation (backend/open webui/main.py): every entry of message ids is validated against the target channel, not just the first; any entry whose target message does not belong to the channel in chat id is rejected.
  2. Fail-closed emitter (backend/open webui/socket/main.py, make channel emitter): before writing, it re-reads the target message and returns without writing unless msg.channel id matches the channel derived from chat id. A missing or mismatched message is a no-op, so a write can no longer land in a channel the caller does not target.

PoC

Single-model (fixed in v0.9.6):
bash
curl -X POST http://target:8080/api/chat/completions 
 -H "Authorization: Bearer $USER JWT" -H "Content-Type: application/json" 
 -d '{
  "model": "llama3", "stream": true,
  "chat id": "channel:any-channel-uuid-here",
  "id": "target-message-uuid-to-overwrite",
  "messages": [{"role": "user", "content": "Repeat exactly: This message has been tampered with"}]
 }'
Multimodel (still works on v0.9.6):
json
POST /api/chat/completions
{
 "chat id": "channel:<attacker channel id>",
 "message ids": {
  "model-a": "<message id in attacker channel>",
  "model-b": "<victim channel message id>"
 },
 "messages": [{"role": "user", "content": "..."}]
}
The first id passes channel scope validation; the second id is used by the per-model fan-out and overwrites the victim-channel message (with model output, or the provider-error string on a deterministic error). Even a failing model call writes error content to the target message.

Impact

Message integrity destruction: an authenticated user can overwrite a message in a channel they cannot access, regardless of membership. The overwritten message retains the original author attribution while displaying attacker-chosen content (impersonation). Private channels, DM channels, and channels the attacker has no access to are all affected; the REST channel routes correctly return 403 for the same attacker, so the bypass is specific to the chat-completion channel pipeline.

Affected versions

  • Single-model path: introduced in commit 0037baeb2 (v0.9.5), fixed in v0.9.6 (#24725).
  • Multimodel message ids path: present from v0.9.6, fixed in v0.10.0.
  • Consolidated Affected: >= 0.9.5, < 0.10.0. Patched: >= 0.10.0.

Distinction from existing CVEs

CVE-2026-45385 (GHSA-wwhq-cx22-f7vv) covered IDOR in the REST endpoint POST /channels/{id}/messages/{message id}/update (routers/channels.py); its fix (commit f5e110f) only touched channels.py. This finding uses a different code path (POST /api/chat/completions with chat id: "channel:<id>" → main.py → socket/main.py: make channel emitter), untouched by that fix.

Suggested fix

Validate every value in message ids against the channel (not just the first), rejecting any whose target message does not belong to the channel in chat id. Additionally, make make channel emitter fail closed: re-check that the target message's channel id matches the channel before calling Messages.update message by id, treating a missing or mismatched message as an error/no-op.

Consolidation

Per Open WebUI's Report Handling policy this advisory consolidates independent reports of the same chat-completions channel-overwrite flaw:
  • Single-model cross-channel overwrite via the channel: path: @sfwani (earliest filing).
  • Multimodel message ids fan-out variant that bypasses the v0.9.6 first-id-only gate: @DavidCarliez.
One CVE for the consolidated advisory.

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-59714
GHSA-X2FF-V5V8-M75M

Affected Products

Open-Webui