CVE-2026-44571: Open webui Open WebUI's Improper Authorization Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jgj3-r8hr-9pjw",
  "modified" : "2026-05-19T15:57:52Z",
  "published" : "2026-05-11T14:05:24Z",
  "aliases" : [ "CVE-2026-44571" ],
  "summary" : "Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission",
  "details" : "## Vulnerability Description\n\nIn standard channels (i.e., channels whose `channel.type` is neither `group` nor `dm`), the endpoint\n\n`POST /api/v1/channels/{channel_id}/messages/{message_id}/update` can be accessed with **read permission only**.\n\nWhen `access_control` is set to `None`, the authorization check `has_access(..., type=\"read\")` evaluates to `True`, allowing users who are **not the message owner** to update messages.\n\nAs a result, unauthorized modification of other users’ messages is possible.\n\n---\n\n## Attack Prerequisites\n\n- The attacker is an authenticated user (role `user` or higher)\n- The target channel is a standard channel (i.e., not `group` or `dm`)\n- `access_control` is `None` or allows `read` access\n- The attacker can obtain the target `message_id` (e.g., via the channel’s message list)\n\n\n\n## Attack Scenario\n\n1. The attacker (User B) retrieves another user’s `message_id` from the message list in a standard channel\n2. The attacker sends a request to\n    \n    `POST /api/v1/channels/{channel_id}/messages/{message_id}/update`\n    \n3. The message authored by another user (User A) is successfully updated\n\n\n\n## Potential Impact\n\n- Unauthorized modification of other users’ messages (violation of data integrity)\n\n\n# Steps to Reproduce\n\n1. Log in as an administrator\n\n<img width=\"3334\" height=\"1668\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b20323d3-c050-4438-8912-193a417654bc\" />\n\n\n2. Create User A\n\n<img width=\"3346\" height=\"788\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b9e4fb8a-b14e-4a4b-b012-02ccfba52fca\" />\n\n3. Create User B\n\n<img width=\"3354\" height=\"796\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f3cf6892-e6c9-4778-b471-f1cc0deec6c8\" />\n\n\n4. Log in as User A\n\n<img width=\"3360\" height=\"1668\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5264ee07-f5c5-4bbe-ad4f-da69fb540fc9\" />\n\n\n5. Log in as User B\n\n<img width=\"3354\" height=\"1670\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f112f8e8-b3e2-4e65-b226-c7b6c986f3bb\" />\n\n\n6. As the administrator, create a new channel\n\n<img width=\"2582\" height=\"988\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bc012d9a-f884-4c83-b6bb-d1e5399f61bb\" />\n\n\n7. As User A, post a new message in the channel\n\n<img width=\"2626\" height=\"962\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d7ff12c2-fe17-44f0-aaf9-5ce2bac9a378\" />\n\n\n8. As User B, edit User A’s message\n\n<img width=\"2604\" height=\"958\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8e19ec3e-fdda-4d36-acd5-f3e1fd3402dd\" />\n\n\n9. Confirm that User A’s message has been modified without authorization\n\n<img width=\"2378\" height=\"1976\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6415fd41-ac68-4d42-83c9-6297caee1fb4\" />\n\n\n## Affected Files and Line Numbers\n\n- `backend/open_webui/routers/channels.py:1417–1460`\n    \n    The authorization check in `update_message_by_id` allows access with **read** permission\n    \n- `backend/open_webui/utils/access_control.py:124–135`\n    \n    When `access_control=None` and `strict=True`, **read** access is permitted\n    \n- `backend/open_webui/models/messages.py:341–358`\n    \n    The update logic does not enforce any message ownership check\n    \n\n## Recommended Mitigation\n\nUpdate the condition in\n\n`backend/open_webui/routers/channels.py:1451–1456`\n\nby changing the permission check from **`read`** to **`write`**, so that only administrators, message owners, or users with write permission can update messages.\n\n### Proposed Changes\n\n- For standard channels, change the update permission requirement from\n    \n    `has_access(..., type=\"read\")` to `has_access(..., type=\"write\")`\n    \n- Preserve the existing ownership check (`message.user_id == user.id`)\n\n## **AI Usage**\n\n- Translation from Japanese to English\n- CWE classification and assessment\n- Affected Files and Line Numbers",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "open-webui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.8.6"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.8.5"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44571"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/open-webui/open-webui"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-11T14:05:24Z",
    "nvd_published_at" : "2026-05-15T22:16:53Z"
  }
}