{"id":"CVE-2026-44571","aliases":["GHSA-jgj3-r8hr-9pjw","PYSEC-2026-2739"],"title":"Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission","summary":"Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","vendor":"open-webui","product":"open-webui","ecosystem":"pip","affected":["open-webui < 0.8.6"],"patched":["open-webui 0.8.6"],"published":"2026-05-11","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-jgj3-r8hr-9pjw","references":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44571"},{"url":"https://github.com/open-webui/open-webui"}],"tags":["osv","pip"],"epss":0.00277,"epssPercentile":0.20361,"ingestedAt":"2026-07-13T18:57:59.722Z","slug":"CVE-2026-44571","body":"## Overview\n\n## Vulnerability Description\n\nIn standard channels (i.e., channels whose `channel.type` is neither `group` nor `dm`), the endpoint\n\n`POST /api/v1/channels/{channel_id}/messages/{message_id}/update` can be accessed with **read permission only**.\n\nWhen `access_control` is set to `None`, the authorization check `has_access(..., type=\"read\")` evaluates to `True`, allowing users who are **not the message owner** to update messages.\n\nAs a result, unauthorized modification of other users’ messages is possible.\n\n---\n\n## Attack Prerequisites\n\n- The attacker is an authenticated user (role `user` or higher)\n- The target channel is a standard channel (i.e., not `group` or `dm`)\n- `access_control` is `None` or allows `read` access\n- The attacker can obtain the target `message_id` (e.g., via the channel’s message list)\n\n\n\n## Attack Scenario\n\n1. The attacker (User B) retrieves another user’s `message_id` from the message list in a standard channel\n2. The attacker sends a request to\n    \n    `POST /api/v1/channels/{channel_id}/messages/{message_id}/update`\n    \n3. The message authored by another user (User A) is successfully updated\n\n\n\n## Potential Impact\n\n- Unauthorized modification of other users’ messages (violation of data integrity)\n\n\n# Steps to Reproduce\n\n1. Log in as an administrator\n\n<img width=\"3334\" height=\"1668\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b20323d3-c050-4438-8912-193a417654bc\" />\n\n\n2. Create User A\n\n<img width=\"3346\" height=\"788\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b9e4fb8a-b14e-4a4b-b012-02ccfba52fca\" />\n\n3. Create User B\n\n<img width=\"3354\" height=\"796\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f3cf6892-e6c9-4778-b471-f1cc0deec6c8\" />\n\n\n4. Log in as User A\n\n<img width=\"3360\" height=\"1668\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5264ee07-f5c5-4bbe-ad4f-da69fb540fc9\" />\n\n\n5. Log in as User B\n\n<img width=\"3354\" height=\"1670\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f112f8e8-b3e2-4e65-b226-c7b6c986f3bb\" />\n\n\n6. As the administrator, create a new channel\n\n<img width=\"2582\" height=\"988\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bc012d9a-f884-4c83-b6bb-d1e5399f61bb\" />\n\n\n7. As User A, post a new message in the channel\n\n<img width=\"2626\" height=\"962\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d7ff12c2-fe17-44f0-aaf9-5ce2bac9a378\" />\n\n\n8. As User B, edit User A’s message\n\n<img width=\"2604\" height=\"958\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8e19ec3e-fdda-4d36-acd5-f3e1fd3402dd\" />\n\n\n9. Confirm that User A’s message has been modified without authorization\n\n<img width=\"2378\" height=\"1976\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6415fd41-ac68-4d42-83c9-6297caee1fb4\" />\n\n\n## Affected Files and Line Numbers\n\n- `backend/open_webui/routers/channels.py:1417–1460`\n    \n    The authorization check in `update_message_by_id` allows access with **read** permission\n    \n- `backend/open_webui/utils/access_control.py:124–135`\n    \n    When `access_control=None` and `strict=True`, **read** access is permitted\n    \n- `backend/open_webui/models/messages.py:341–358`\n    \n    The update logic does not enforce any message ownership check\n    \n\n## Recommended Mitigation\n\nUpdate the condition in\n\n`backend/open_webui/routers/channels.py:1451–1456`\n\nby changing the permission check from **`read`** to **`write`**, so that only administrators, message owners, or users with write permission can update messages.\n\n### Proposed Changes\n\n- For standard channels, change the update permission requirement from\n    \n    `has_access(..., type=\"read\")` to `has_access(..., type=\"write\")`\n    \n- Preserve the existing ownership check (`message.user_id == user.id`)\n\n## **AI Usage**\n\n- Translation from Japanese to English\n- CWE classification and assessment\n- Affected Files and Line Numbers\n\n## Affected packages\n\n- `open-webui < 0.8.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `open-webui 0.8.6`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}