CVE-2026-59215: Open WebUI Private Channel Messages Can Be Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-73x5-h92w-xc2j",
  "modified" : "2026-07-24T17:04:31Z",
  "published" : "2026-07-24T17:04:31Z",
  "aliases" : [ "CVE-2026-59215" ],
  "summary" : "Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding",
  "details" : "## Summary\n\nA normal authenticated user can read the content of a message in a private channel they do not belong to. `GET /api/v1/channels/{id}/messages/{message_id}/thread` authorizes the caller against the URL channel, but the underlying thread lookup loads the thread *parent* by id and returns it without verifying the parent belongs to that channel. By requesting a thread in a channel they can access while supplying a victim channel's message id as the thread root, the attacker receives the victim message — content, channel id, and author.\n\n## Affected component\n\n- `backend/open_webui/models/messages.py` — `get_messages_by_parent_id()`\n- `backend/open_webui/routers/channels.py` — `get_channel_thread_messages()` (read), `new_message_handler()` (parent/reply binding on write)\n\n## Root cause\n\n`get_messages_by_parent_id(channel_id, parent_id)` filters the thread *replies* by `channel_id`, but loads the thread *parent* by id alone and appends it without requiring `parent.channel_id == channel_id`:\n\n```python\nmessage = await db.get(Message, parent_id)     # loaded by id only — no channel binding\nif not message:\n    return []\n# replies are filtered by channel_id ...\nif len(all_messages) < limit:\n    all_messages.append(message)               # parent appended unconditionally\n```\n\n`get_channel_thread_messages()` authorizes only the URL channel, then calls `get_messages_by_parent_id(id, message_id)` with the caller-supplied `message_id`. The reply insert path (`new_message_handler` → `insert_new_message`) also stored a caller-supplied `parent_id` without binding it to the channel.\n\n## Impact\n\nA non-member can disclose the content (plus channel id and author metadata) of a private-channel message whose id they know or obtain. Direct reads of the victim channel/message/thread return 403; the disclosure is via the thread parent of a channel the attacker can access. Read-only, one message per known id.\n\n## Proof of Concept\n\n(reporter) Validated on v0.9.6: `GET /channels/{attacker_channel}/messages/{victim_message_id}/thread` returned the victim's private message — content, victim channel id, and author — although direct reads of the victim channel returned 403.\n\n## Fix\n\nBind the thread parent to the requested channel: `get_messages_by_parent_id` returns `[]` unless the parent exists and `parent.channel_id == channel_id`. Defence-in-depth on the write path: `new_message_handler` rejects a supplied `parent_id`/`reply_to_id` whose message does not belong to the URL channel.\n\n## Affected / Patched\n\n- Affected: `< 0.10.0` (last affected release 0.9.6)\n- Patched: v0.10.0 (PR #25766). `get_messages_by_parent_id` binds the thread parent to the requested channel (returns `[]` unless `parent.channel_id == channel_id`), and `new_message_handler` rejects a caller-supplied `parent_id`/`reply_to_id` whose message does not belong to the channel.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "open-webui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.10.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/security/advisories/GHSA-73x5-h92w-xc2j"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59215"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/pull/25766"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/commit/a66477b7104c5d141ce7bffaea424b43e7666ef1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/open-webui/open-webui"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/releases/tag/v0.10.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-24T17:04:31Z",
    "nvd_published_at" : "2026-07-09T17:17:02Z"
  }
}