| Package | Affected versions | Patched versions |
|---|---|---|
| open-webui | ≥ 0.7.0, < 0.10.0 | 0.10.0 |
| open webui | ≥ 0.7.0, < 0.10.0 | 0.10.0 |
The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (settings.ui.toolServers[].key), which is not available via standard user info APIs.
The endpoint GET /api/v1/channels/{id}/members returns the full serialized user model for every member in the channel. In both the DM and non-DM code paths, the handler constructs the response with [UserModelResponse(**user.model_dump(), is_active=...)] and returns it as the users list. Because UserModel (models/users.py) includes a settings object (UserSettings) and arbitrary UI configuration (settings.ui), the endpoint exposes other users' sensitive configuration to any channel participant.
Practically, a regular user who participates in a DM or group can call /api/v1/channels/{id}/members and receive other members' settings, including admin-only details such as webhook notification URLs and tool server configuration, including credential fields like settings.ui.toolServers[].key. These values are not returned by the normal user profile endpoints (e.g., /api/v1/users/{user_id}/info).
+ after Manage Tool Servers to add some tool server with a secret Bearer token (eg. KEY)/api/v1/channels/{id}/members request which responds with the settings key including toolServers and key values:The attacker has now leaked the admin's bearer token for the toolserver they configured.
<img width="400" alt="app aikido dev_ai-pentests_projects_116389_assessments_019d67d4-81c8-7dd2-bb9e-0a4a774b2c78_issues_sidebarIssue=20440423 (4)" src="https://github.com/user-attachments/assets/8415553a-9f1e-4f73-929c-aa0d18a101ca" />Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeConditions for exploit: channels are enabled and an attacker has a low-privilege account.
Webhook URLs and tool server configurations (including bearer keys) can be exfiltrated from any user.