CVE-2026-44571

Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission

6.5 MediumFix available

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, in standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only. When access_control is set to None, the authorization check has_access(..., type="read") evaluates to True, allowing users who are not the message owner to update messages. As a result, unauthorized modification of other users’ messages is possible. This vulnerability is fixed in 0.8.6.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.28%Up 0.3 points since May 16, 2026

What each source reports

CVE List Score used 6.5

Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Record: CVE-2026-44571
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2026-30655 6.5

Record: EUVD-2026-30655
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jgj3-r8hr-9pjw 6.5

Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Vulnerability Description

In standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint

POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only.

When access_control is set to None, the authorization check has_access(..., type="read") evaluates to True, allowing users who are not the message owner to update messages.

As a result, unauthorized modification of other users’ messages is possible.

Attack Prerequisites

The attacker is an authenticated user (role user or higher)
The target channel is a standard channel (i.e., not group or dm)
access_control is None or allows read access
The attacker can obtain the target message_id (e.g., via the channel’s message list)

Attack Scenario

The attacker (User B) retrieves another user’s message_id from the message list in a standard channel
The attacker sends a request to

POST /api/v1/channels/{channel_id}/messages/{message_id}/update
The message authored by another user (User A) is successfully updated

Potential Impact

Unauthorized modification of other users’ messages (violation of data integrity)

Steps to Reproduce

Create User A

Create User B

As the administrator, create a new channel

As User A, post a new message in the channel

As User B, edit User A’s message

Confirm that User A’s message has been modified without authorization

Affected Files and Line Numbers

backend/open_webui/routers/channels.py:1417–1460

The authorization check in update_message_by_id allows access with read permission
backend/open_webui/utils/access_control.py:124–135

When access_control=None and strict=True, read access is permitted
backend/open_webui/models/messages.py:341–358

The update logic does not enforce any message ownership check

Recommended Mitigation

Update the condition in

backend/open_webui/routers/channels.py:1451–1456

by changing the permission check from read to write, so that only administrators, message owners, or users with write permission can update messages.

Proposed Changes

For standard channels, change the update permission requirement from

has_access(..., type="read") to has_access(..., type="write")
Preserve the existing ownership check (message.user_id == user.id)

AI Usage

Translation from Japanese to English
CWE classification and assessment
Affected Files and Line Numbers

Record: GHSA-jgj3-r8hr-9pjw
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

NVD 6.5

Record: CVE-2026-44571
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSV 6.5

Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Record: CVE-2026-44571
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSVGHSA-jgj3-r8hr-9pjw 6.5

Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Vulnerability Description

In standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint

POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only.

When access_control is set to None, the authorization check has_access(..., type="read") evaluates to True, allowing users who are not the message owner to update messages.

As a result, unauthorized modification of other users’ messages is possible.

Attack Prerequisites

The attacker is an authenticated user (role user or higher)
The target channel is a standard channel (i.e., not group or dm)
access_control is None or allows read access
The attacker can obtain the target message_id (e.g., via the channel’s message list)

Attack Scenario

The attacker (User B) retrieves another user’s message_id from the message list in a standard channel
The attacker sends a request to

POST /api/v1/channels/{channel_id}/messages/{message_id}/update
The message authored by another user (User A) is successfully updated

Potential Impact

Unauthorized modification of other users’ messages (violation of data integrity)

Steps to Reproduce

Create User A

Create User B

As the administrator, create a new channel

As User A, post a new message in the channel

As User B, edit User A’s message

Confirm that User A’s message has been modified without authorization

Affected Files and Line Numbers

backend/open_webui/routers/channels.py:1417–1460

The authorization check in update_message_by_id allows access with read permission
backend/open_webui/utils/access_control.py:124–135

When access_control=None and strict=True, read access is permitted
backend/open_webui/models/messages.py:341–358

The update logic does not enforce any message ownership check

Recommended Mitigation

Update the condition in

backend/open_webui/routers/channels.py:1451–1456

by changing the permission check from read to write, so that only administrators, message owners, or users with write permission can update messages.

Proposed Changes

For standard channels, change the update permission requirement from

has_access(..., type="read") to has_access(..., type="write")
Preserve the existing ownership check (message.user_id == user.id)

AI Usage

Translation from Japanese to English
CWE classification and assessment
Affected Files and Line Numbers

Record: GHSA-jgj3-r8hr-9pjw
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSVPYSEC-2026-2739 6.5

Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Vulnerability Description

In standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint

POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only.

When access_control is set to None, the authorization check has_access(..., type="read") evaluates to True, allowing users who are not the message owner to update messages.

As a result, unauthorized modification of other users’ messages is possible.

Attack Prerequisites

The attacker is an authenticated user (role user or higher)
The target channel is a standard channel (i.e., not group or dm)
access_control is None or allows read access
The attacker can obtain the target message_id (e.g., via the channel’s message list)

Attack Scenario

The attacker (User B) retrieves another user’s message_id from the message list in a standard channel
The attacker sends a request to

POST /api/v1/channels/{channel_id}/messages/{message_id}/update
The message authored by another user (User A) is successfully updated

Potential Impact

Unauthorized modification of other users’ messages (violation of data integrity)

Steps to Reproduce

Create User A

Create User B

As the administrator, create a new channel

As User A, post a new message in the channel

As User B, edit User A’s message

Confirm that User A’s message has been modified without authorization

Affected Files and Line Numbers

backend/open_webui/routers/channels.py:1417–1460

The authorization check in update_message_by_id allows access with read permission
backend/open_webui/utils/access_control.py:124–135

When access_control=None and strict=True, read access is permitted
backend/open_webui/models/messages.py:341–358

The update logic does not enforce any message ownership check

Recommended Mitigation

Update the condition in

backend/open_webui/routers/channels.py:1451–1456

by changing the permission check from read to write, so that only administrators, message owners, or users with write permission can update messages.

Proposed Changes

For standard channels, change the update permission requirement from

has_access(..., type="read") to has_access(..., type="write")
Preserve the existing ownership check (message.user_id == user.id)

AI Usage

Translation from Japanese to English
CWE classification and assessment
Affected Files and Line Numbers

Record: PYSEC-2026-2739
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`open-webui` PyPI	through 0.8.5	0.8.6
`open-webui` PyPI	before 0.8.6, plus listed versions 0.1.1240.1.1250.2.00.2.10.2.2 Show 45 moreShow less 0.2.30.2.40.2.50.3.00.3.10.3.100.3.120.3.130.3.140.3.150.3.160.3.170.3.17.dev20.3.17.dev30.3.17.dev40.3.17.dev50.3.180.3.190.3.20.3.200.3.210.3.220.3.230.3.240.3.250.3.260.3.270.3.27.dev10.3.27.dev20.3.27.dev30.3.280.3.290.3.30.3.300.3.30.dev10.3.30.dev20.3.310.3.31.dev10.3.320.3.330.3.33.dev10.3.340.3.350.3.40.3.5	0.8.6

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44571 is a medium vulnerability (CVSS 6.5) in Openwebui Open Webui, published May 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in open-webui 0.8.6.

References

This page doesn't list everything

Left out here: 94 versions. The JSON record has them.