| Package | Affected versions | Patched versions |
|---|---|---|
| open-webui | < 0.8.6 | 0.8.6 |
| open webui | < 0.8.6 | 0.8.6 |
In standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint
POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only.
When access_control is set to None, the authorization check has_access(..., type="read") evaluates to True, allowing users who are not the message owner to update messages.
As a result, unauthorized modification of other users’ messages is possible.
user or higher)group or dm)access_control is None or allows read accessmessage_id (e.g., via the channel’s message list)The attacker (User B) retrieves another user’s message_id from the message list in a standard channel
The attacker sends a request to
POST /api/v1/channels/{channel_id}/messages/{message_id}/update
The message authored by another user (User A) is successfully updated
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freebackend/open_webui/routers/channels.py:1417–1460
The authorization check in update_message_by_id allows access with read permission
backend/open_webui/utils/access_control.py:124–135
When access_control=None and strict=True, read access is permitted
backend/open_webui/models/messages.py:341–358
The update logic does not enforce any message ownership check
Update the condition in
backend/open_webui/routers/channels.py:1451–1456
by changing the permission check from read to write, so that only administrators, message owners, or users with write permission can update messages.
For standard channels, change the update permission requirement from
has_access(..., type="read") to has_access(..., type="write")
Preserve the existing ownership check (message.user_id == user.id)