Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id but did not verify that the calling user authored the targeted message. A channel member could use the chat completions endpoint to replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T22:18:47.563Z",
  "pubdate": "2026-09-09T22:18:47.563Z",
  "executiveSummary": "A broken access control vulnerability exists in Open WebUI versions 0.9.5 through 0.11.1, specifically within the chat_completion channel logic. The vulnerability allows an authenticated channel member to perform unauthorized modifications to existing conversation records.\nThe flaw stems from insufficient authorization checks within the backend/open_webui/main.py script. While the application correctly validates that a user has membership and write access to a channel, it fails to perform a secondary validation check to ensure the user is the original author of the message being modified.\nConsequently, any malicious actor with legitimate access to a shared channel can supply a targeted message_id to the chat completions endpoint to overwrite the content of another user's message. By doing so, the attacker forces the application to retain the victim's identity as the author, effectively enabling unauthorized message tampering and data integrity manipulation within the collaborative AI environment.\nThe risk is limited to the scope of the affected channel, as the vulnerability does not grant cross-channel access. Successful exploitation requires the attacker to be an authenticated member of the target channel.",
  "technicalDetails": "The vulnerability is located in the chat_completion function within backend/open_webui/main.py. The root cause is a logic error in the authorization middleware governing message operations. During the execution of the chat completion workflow, the application processes a supplied message_id to determine if the requested modification is permissible.\nThe application performs a coarse-grained authorization check by validating that the authenticated requester has membership and write permissions for the channel containing the targeted message_id. However, the logic fails to implement a fine-grained 'ownership' check that compares the UID of the requesting user against the UID stored in the message record's metadata. This lack of ownership verification constitutes an Insecure Direct Object Reference (IDOR) pattern variant where the input parameter (message_id) is improperly validated against the user's session context.\nExploitation follows a predictable flow: first, the attacker identifies a valid message_id within a shared channel where they possess member privileges. Second, the attacker constructs a request to the chat completions endpoint, injecting the target message_id. Because the backend verifies the requester’s channel access, the request bypasses the initial security gateway. Third, the backend accepts the modification request and updates the database entry for the message.\nBy manipulating the conversation state, the attacker can replace the content of a victim's message with malicious or misleading text. Because the application logic does not update the message authorship metadata during this operation, the modification persists under the identity of the victim. This enables a form of communication spoofing or data poisoning where users appear to have 'said' things they did not, potentially compromising the integrity of historical decision-making or collaborative logs in AI-assisted workflows.\nThe vulnerability affects all instances of Open WebUI between versions 0.9.5 and 0.11.1. It is accessible to any user authenticated within the application who holds valid membership in a channel, requiring no elevated administrative privileges or specific network positioning, provided they can interact with the standard chat completions API endpoint."
}