https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 07:34:42 +0000 https://vulnerability.circl.lu/vuln/cve-2026-59714 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This issue is fixed in version 0.10.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This issue is fixed in version 0.10.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-59714 https://vulnerability.circl.lu/vuln/ghsa-x2ff-v5v8-m75m <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a `channel:`-prefixed `chat_id` and a target `message_id`. The `channel:` path routes pipeline output through `_make_channel_emitter`, which writes to the `Messages` table using the caller-supplied `message_id` without binding it to the channel.</p> <p>This advisory consolidates two filings of the same flaw: the original single-model form, and a multimodel `message_ids` variant that survives the partial fix shipped in v0.9.6 (see &#34;Fix status&#34; below).</p> <p>## Details (as introduced in v0.9.5)</p> <p>When a user submits a chat completion request with a `chat_id` starting with `channel:`, three authorization gaps combined in v0.9.5:</p> <p>1. **Ownership check skipped** (`main.py`): the `channel:` prefix caused the entire ownership/membership verification block to be skipped, with no channel membership/write check replacing it.</p> <p>```python if not chat_id.startswith(&#39;local:&#39;) and not chat_id.startswith(&#39;channel:&#39;): # temporary/channel chats are not stored if is_new_chat: ... else: if not await Chats.is_chat_owner(chat_id, user.id) and user.role != &#39;admin&#39;: raise HTTPException(...) ```</p> <p>2. **Message ID from user input**: `id` (and each value of the multimodel `message_ids` map) comes directly from the request body and is passed as `message_id` to the channel emitter.</p> <p>3. **Unchecked…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a `channel:`-prefixed `chat_id` and a target `message_id`. The `channel:` path routes pipeline output through `_make_channel_emitter`, which writes to the `Messages` table using the caller-supplied `message_id` without binding it to the channel.</p> <p>This advisory consolidates two filings of the same flaw: the original single-model form, and a multimodel `message_ids` variant that survives the partial fix shipped in v0.9.6 (see &#34;Fix status&#34; below).</p> <p>## Details (as introduced in v0.9.5)</p> <p>When a user submits a chat completion request with a `chat_id` starting with `channel:`, three authorization gaps combined in v0.9.5:</p> <p>1. **Ownership check skipped** (`main.py`): the `channel:` prefix caused the entire ownership/membership verification block to be skipped, with no channel membership/write check replacing it.</p> <p>```python if not chat_id.startswith(&#39;local:&#39;) and not chat_id.startswith(&#39;channel:&#39;): # temporary/channel chats are not stored if is_new_chat: ... else: if not await Chats.is_chat_owner(chat_id, user.id) and user.role != &#39;admin&#39;: raise HTTPException(...) ```</p> <p>2. **Message ID from user input**: `id` (and each value of the multimodel `message_ids` map) comes directly from the request body and is passed as `message_id` to the channel emitter.</p> <p>3. **Unchecked…</p> https://vulnerability.circl.lu/vuln/ghsa-x2ff-v5v8-m75m