Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This issue is fixed in version 0.10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T20:17:23.280Z",
  "pubdate": "2026-08-13T20:17:23.280Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) and authorization bypass vulnerability exists in Open WebUI from version 0.9.5 before 0.10.0.\nThe flaw allows any authenticated user to arbitrarily overwrite message content within arbitrary channels, including private and direct message (DM) channels to which the user does not belong.\nThe vulnerability arises due to improper input validation and lack of authorization checks during pipeline output routing.\nAn attacker possessing standard authenticated user privileges can exploit this issue by supplying a manipulated chat completion request containing a channel:-prefixed chat_id and a target message_id.\nSuccessful exploitation compromises the integrity and confidentiality of communications across the affected system, enabling malicious actors to tamper with historical message records in restricted or private conversational contexts.\nRisk implications include data tampering, unauthorized modification of sensitive discourse, and potential social engineering or disinformation campaigns within collaborative or isolated chat spaces.\nExploitation requires active authentication on the target Open WebUI instance and the ability to submit crafted chat completion requests targeting arbitrary message identifiers.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control enforcement and missing authorization validation within the message routing and persistence logic of Open WebUI.\nSpecifically, when a chat completion request is processed using a channel:-prefixed chat_id, the underlying application logic routes the pipeline output through the vulnerable function _make_channel_emitter.\nThe vulnerable component (_make_channel_emitter) directly writes data to the Messages table in the backend database utilizing the caller-supplied message_id.\nCrucially, the function fails to validate whether the authenticated caller possesses membership or administrative privileges within the specified channel, nor does it cryptographically or logically bind the supplied message_id to the authorized execution context of the requesting user.\nThis architectural oversight enables a classic authorization bypass via IDOR, where user-supplied object identifiers are trusted implicitly without verifying ownership or access rights.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts a malicious chat completion HTTP request targeting the Open WebUI backend API. Within this request, the attacker specifies a manipulated chat_id prefixed with the channel: string, alongside a chosen target message_id corresponding to a message residing inside a private channel or DM channel that the attacker is not authorized to access.\nSecond, the application processes the request, routing the payload generation through _make_channel_emitter.\nThird, _make_channel_emitter executes a write operation against the Messages table using the attacker-controlled message_id, thereby overwriting the pre-existing message content with the arbitrary pipeline output supplied in the attack request.\nAffected versions include Open WebUI from 0.9.5 up to, but not including, 0.10.0.\nAuthentication requirements dictate that the attacker must possess a valid, active user session on the target instance; however, no elevated or administrative privileges are required.\nNetwork exposure encompasses any environment where the Open WebUI instance accepts authenticated API requests, potentially exposing internal deployments if perimeter controls are bypassed.\nThe post-exploitation impact includes unauthorized modification of message integrity, destruction of forensic logs, alteration of administrative directives transmitted via chat, and unauthorized insertion of misleading data into private communication channels."
}