{"id":"CVE-2026-59222","aliases":["GHSA-gh7p-78x6-jw6m"],"title":"Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials","summary":"Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials","severity":"medium","cwe":["CWE-200"],"vendor":"open-webui","product":"open-webui","ecosystem":"pip","affected":["open-webui >= 0.7.0, < 0.10.0"],"patched":["open-webui 0.10.0"],"published":"2026-07-24","updated":"2026-07-24","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-gh7p-78x6-jw6m","references":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-gh7p-78x6-jw6m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59222"},{"url":"https://github.com/open-webui/open-webui/commit/fbcdcf146b99b5002705060a8243eee769108f9e"},{"url":"https://github.com/open-webui/open-webui/releases/tag/v0.10.0"},{"url":"https://github.com/advisories/GHSA-gh7p-78x6-jw6m"}],"tags":["ghsa","pip"],"epss":0.00322,"epssPercentile":0.25476,"ingestedAt":"2026-07-24T17:34:27.125Z","slug":"CVE-2026-59222","body":"## Overview\n\n### Summary\n\nThe channel members endpoint serializes and returns **full user models** for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (`settings.ui.toolServers[].key`), which is not available via standard user info APIs.\n\n### Details\n\nThe endpoint GET `/api/v1/channels/{id}/members` returns the full serialized user model for every member in the channel. In both the DM and non-DM code paths, the handler constructs the response with `[UserModelResponse(**user.model_dump(), is_active=...)]` and returns it as the users list. Because `UserModel` (`models/users.py`) includes a settings object (`UserSettings`) and arbitrary UI configuration (`settings.ui`), the endpoint exposes other users' sensitive configuration to any channel participant.\n\nPractically, a regular user who participates in a DM or group can call `/api/v1/channels/{id}/members` and receive other members' settings, including admin-only details such as webhook notification URLs and tool server configuration, including credential fields like `settings.ui.toolServers[].key`. These values are not returned by the normal user profile endpoints (e.g., `/api/v1/users/{user_id}/info`).\n\n### PoC\n\n1. Start a local Open WebUI instance\n2. Log in as admin and in the Admin Panel, go to Settings -> General and check *Channels (Beta)*, then press Save.\n3. Create a low-privilege user in the Users tab\n4. Click on the admin's profile bottom left, Settings and Integrations. Then click the `+` after *Manage Tool Servers* to add some tool server with a secret Bearer token (eg. `KEY`)\n5. Log in as the attacker with the low-privilege account and create a new Direct Message channel with the admin user:\n\n\"image\"\n\n7. After creating, open DevTools with F12 and go to the Network tab. Then in the DM UI click on the *Users* icon top right to see the members. In the network tab, this should have triggered a `/api/v1/channels/{id}/members` request which responds with the `settings` key including `toolServers` and `key` values:\n\n\"image\"\n\nThe attacker has now leaked the admin's bearer token for the toolserver they configured.\n\n### Impact\n\nConditions for exploit: channels are enabled and an attacker has a low-privilege account.\n\nWebhook URLs and tool server configurations (including bearer keys) can be exfiltrated from any user.\n\n### Original Agent Report\n\n\"app\n\n## Affected packages\n\n- `open-webui >= 0.7.0, < 0.10.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `open-webui 0.10.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}