{"id":"CVE-2026-59222","aliases":["EUVD-2026-42631","GHSA-gh7p-78x6-jw6m","PYSEC-2026-3598"],"status":"published","title":"Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials","description":"Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00462,"percentile":0.40519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-07-09T16:59:10Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"PyPI","package":"open-webui","fixed_in":["0.10.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"open-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"fixed":"0.10.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"open-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"fixed":"0.10.0"}]}],"versions":["0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.10","0.8.11","0.8.12","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6"]},{"source":"osv","ecosystem":"PyPI","package":"open-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"fixed":"0.10.0"}]}],"versions":["0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.10","0.8.11","0.8.12","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6"]}],"products":[{"vendor":"open-webui","product":"open-webui"},{"vendor":"openwebui","product":"open_webui"}],"references":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-gh7p-78x6-jw6m","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/open-webui/open-webui/commit/fbcdcf146b99b5002705060a8243eee769108f9e","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/open-webui/open-webui/releases/tag/v0.10.0","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59222","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gh7p-78x6-jw6m","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59222.json","tags":["advisory"]},{"url":"https://github.com/open-webui/open-webui","tags":["package"]},{"url":"https://pypi.org/project/open-webui","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-59222","title":"Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials","description":"Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0.","status":"published","published":"2026-07-09T16:59:10.208Z","modified":"2026-07-09T17:29:39.729Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-42631","description":"Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0.","status":"published","published":"2026-07-09T16:59:10Z","modified":"2026-07-09T17:29:39Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:03.742277Z"}],"ghsa":[{"id":"GHSA-gh7p-78x6-jw6m","title":"Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials","description":"### Summary\n\nThe channel members endpoint serializes and returns **full user models** for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (`settings.ui.toolServers[].key`), which is not available via standard user info APIs.\n\n### Details\n\nThe endpoint GET `/api/v1/channels/{id}/members` returns the full serialized user model for every member in the channel. In both the DM and non-DM code paths, the handler constructs the response with `[UserModelResponse(**user.model_dump(), is_active=...)]` and returns it as the users list. Because `UserModel` (`models/users.py`) includes a settings object (`UserSettings`) and arbitrary UI configuration (`settings.ui`), the endpoint exposes other users' sensitive configuration to any channel participant.\n\nPractically, a regular user who participates in a DM or group can call `/api/v1/channels/{id}/members` and receive other members' settings, including admin-only details such as webhook notification URLs and tool server configuration, including credential fields like `settings.ui.toolServers[].key`. These values are not returned by the normal user profile endpoints (e.g., `/api/v1/users/{user_id}/info`).\n\n### PoC\n\n1. Start a local Open WebUI instance\n2. Log in as admin and in the Admin Panel, go to Settings -\u003e General and check *Channels (Beta)*, then press Save.\n3. Create a low-privilege user in the Users tab\n4. Click on the admin's profile bottom left, Settings and Integrations. Then click the `+` after *Manage Tool Servers* to add some tool server with a secret Bearer token (eg. `KEY`)\n5. Log in as the attacker with the low-privilege account and create a new Direct Message channel with the admin user:\n\n\u003cimg width=\"690\" height=\"383\" alt=\"image\" src=\"https://github.com/user-attachments/assets/70208661-a0db-4457-9984-119056ca3daf\" /\u003e\n\n7. After creating, open DevTools with F12 and go to the Network tab. Then in the DM UI click on the *Users* icon top right to see the members. In the network tab, this should have triggered a `/api/v1/channels/{id}/members` request which responds with the `settings` key including `toolServers` and `key` values:\n\n\u003cimg width=\"1642\" height=\"577\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6639d982-a156-4e8b-861e-587d86d9b152\" /\u003e\n\nThe attacker has now leaked the admin's bearer token for the toolserver they configured.\n\n### Impact\n\nConditions for exploit: channels are enabled and an attacker has a low-privilege account.\n\nWebhook URLs and tool server configurations (including bearer keys) can be exfiltrated from any user.\n\n### Original Agent Report\n\n\u003cimg width=\"400\" alt=\"app aikido dev_ai-pentests_projects_116389_assessments_019d67d4-81c8-7dd2-bb9e-0a4a774b2c78_issues_sidebarIssue=20440423 (4)\" src=\"https://github.com/user-attachments/assets/8415553a-9f1e-4f73-929c-aa0d18a101ca\" /\u003e","status":"published","published":"2026-07-24T17:04:55Z","modified":"2026-08-13T13:45:13Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-59222","description":"Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0.","status":"published","published":"2026-07-09T17:17:03.353Z","modified":"2026-07-10T17:43:06.18Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-59222","title":"Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials","description":"Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0.","status":"published","published":"2026-07-09T16:59:10.208Z","modified":"2026-10-28T02:31:03.851794039Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-gh7p-78x6-jw6m","title":"Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials","description":"### Summary\n\nThe channel members endpoint serializes and returns **full user models** for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (`settings.ui.toolServers[].key`), which is not available via standard user info APIs.\n\n### Details\n\nThe endpoint GET `/api/v1/channels/{id}/members` returns the full serialized user model for every member in the channel. In both the DM and non-DM code paths, the handler constructs the response with `[UserModelResponse(**user.model_dump(), is_active=...)]` and returns it as the users list. Because `UserModel` (`models/users.py`) includes a settings object (`UserSettings`) and arbitrary UI configuration (`settings.ui`), the endpoint exposes other users' sensitive configuration to any channel participant.\n\nPractically, a regular user who participates in a DM or group can call `/api/v1/channels/{id}/members` and receive other members' settings, including admin-only details such as webhook notification URLs and tool server configuration, including credential fields like `settings.ui.toolServers[].key`. These values are not returned by the normal user profile endpoints (e.g., `/api/v1/users/{user_id}/info`).\n\n### PoC\n\n1. Start a local Open WebUI instance\n2. Log in as admin and in the Admin Panel, go to Settings -\u003e General and check *Channels (Beta)*, then press Save.\n3. Create a low-privilege user in the Users tab\n4. Click on the admin's profile bottom left, Settings and Integrations. Then click the `+` after *Manage Tool Servers* to add some tool server with a secret Bearer token (eg. `KEY`)\n5. Log in as the attacker with the low-privilege account and create a new Direct Message channel with the admin user:\n\n\u003cimg width=\"690\" height=\"383\" alt=\"image\" src=\"https://github.com/user-attachments/assets/70208661-a0db-4457-9984-119056ca3daf\" /\u003e\n\n7. After creating, open DevTools with F12 and go to the Network tab. Then in the DM UI click on the *Users* icon top right to see the members. In the network tab, this should have triggered a `/api/v1/channels/{id}/members` request which responds with the `settings` key including `toolServers` and `key` values:\n\n\u003cimg width=\"1642\" height=\"577\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6639d982-a156-4e8b-861e-587d86d9b152\" /\u003e\n\nThe attacker has now leaked the admin's bearer token for the toolserver they configured.\n\n### Impact\n\nConditions for exploit: channels are enabled and an attacker has a low-privilege account.\n\nWebhook URLs and tool server configurations (including bearer keys) can be exfiltrated from any user.\n\n### Original Agent Report\n\n\u003cimg width=\"400\" alt=\"app aikido dev_ai-pentests_projects_116389_assessments_019d67d4-81c8-7dd2-bb9e-0a4a774b2c78_issues_sidebarIssue=20440423 (4)\" src=\"https://github.com/user-attachments/assets/8415553a-9f1e-4f73-929c-aa0d18a101ca\" /\u003e","status":"published","published":"2026-07-24T17:04:55Z","modified":"2026-08-04T14:41:00.444740805Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"PYSEC-2026-3598","title":"Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials","description":"### Summary\n\nThe channel members endpoint serializes and returns **full user models** for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (`settings.ui.toolServers[].key`), which is not available via standard user info APIs.\n\n### Details\n\nThe endpoint GET `/api/v1/channels/{id}/members` returns the full serialized user model for every member in the channel. In both the DM and non-DM code paths, the handler constructs the response with `[UserModelResponse(**user.model_dump(), is_active=...)]` and returns it as the users list. Because `UserModel` (`models/users.py`) includes a settings object (`UserSettings`) and arbitrary UI configuration (`settings.ui`), the endpoint exposes other users' sensitive configuration to any channel participant.\n\nPractically, a regular user who participates in a DM or group can call `/api/v1/channels/{id}/members` and receive other members' settings, including admin-only details such as webhook notification URLs and tool server configuration, including credential fields like `settings.ui.toolServers[].key`. These values are not returned by the normal user profile endpoints (e.g., `/api/v1/users/{user_id}/info`).\n\n### PoC\n\n1. Start a local Open WebUI instance\n2. Log in as admin and in the Admin Panel, go to Settings -\u003e General and check *Channels (Beta)*, then press Save.\n3. Create a low-privilege user in the Users tab\n4. Click on the admin's profile bottom left, Settings and Integrations. Then click the `+` after *Manage Tool Servers* to add some tool server with a secret Bearer token (eg. `KEY`)\n5. Log in as the attacker with the low-privilege account and create a new Direct Message channel with the admin user:\n\n\u003cimg width=\"690\" height=\"383\" alt=\"image\" src=\"https://github.com/user-attachments/assets/70208661-a0db-4457-9984-119056ca3daf\" /\u003e\n\n7. After creating, open DevTools with F12 and go to the Network tab. Then in the DM UI click on the *Users* icon top right to see the members. In the network tab, this should have triggered a `/api/v1/channels/{id}/members` request which responds with the `settings` key including `toolServers` and `key` values:\n\n\u003cimg width=\"1642\" height=\"577\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6639d982-a156-4e8b-861e-587d86d9b152\" /\u003e\n\nThe attacker has now leaked the admin's bearer token for the toolserver they configured.\n\n### Impact\n\nConditions for exploit: channels are enabled and an attacker has a low-privilege account.\n\nWebhook URLs and tool server configurations (including bearer keys) can be exfiltrated from any user.\n\n### Original Agent Report\n\n\u003cimg width=\"400\" alt=\"app aikido dev_ai-pentests_projects_116389_assessments_019d67d4-81c8-7dd2-bb9e-0a4a774b2c78_issues_sidebarIssue=20440423 (4)\" src=\"https://github.com/user-attachments/assets/8415553a-9f1e-4f73-929c-aa0d18a101ca\" /\u003e","status":"published","published":"2026-08-04T11:34:43.067043Z","modified":"2026-08-04T14:30:28.669263333Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.847083Z"}]}}