{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44571",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-15T22:18:47.253332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T22:21:29.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-webui",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, in standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint POST /api/v1/channels/{channel_id}/messages/{message_id}/update can be accessed with read permission only. When access_control is set to None, the authorization check has_access(..., type=\"read\") evaluates to True, allowing users who are not the message owner to update messages. As a result, unauthorized modification of other users\u2019 messages is possible. This vulnerability is fixed in 0.8.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-15T21:24:52.186Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjw"
        }
      ],
      "source": {
        "advisory": "GHSA-jgj3-r8hr-9pjw",
        "discovery": "UNKNOWN"
      },
      "title": "Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44571",
    "datePublished": "2026-05-15T21:24:52.186Z",
    "dateReserved": "2026-05-06T20:59:00.596Z",
    "dateUpdated": "2026-05-15T22:21:29.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44571"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-11T14:05:24Z",
    "nvd_published_at": "2026-05-15T22:16:53Z",
    "severity": "MODERATE"
  },
  "details": "## Vulnerability Description\n\nIn standard channels (i.e., channels whose `channel.type` is neither `group` nor `dm`), the endpoint\n\n`POST /api/v1/channels/{channel_id}/messages/{message_id}/update` can be accessed with **read permission only**.\n\nWhen `access_control` is set to `None`, the authorization check `has_access(..., type=\"read\")` evaluates to `True`, allowing users who are **not the message owner** to update messages.\n\nAs a result, unauthorized modification of other users\u2019 messages is possible.\n\n---\n\n## Attack Prerequisites\n\n- The attacker is an authenticated user (role `user` or higher)\n- The target channel is a standard channel (i.e., not `group` or `dm`)\n- `access_control` is `None` or allows `read` access\n- The attacker can obtain the target `message_id` (e.g., via the channel\u2019s message list)\n\n\n\n## Attack Scenario\n\n1. The attacker (User B) retrieves another user\u2019s `message_id` from the message list in a standard channel\n2. The attacker sends a request to\n    \n    `POST /api/v1/channels/{channel_id}/messages/{message_id}/update`\n    \n3. The message authored by another user (User A) is successfully updated\n\n\n\n## Potential Impact\n\n- Unauthorized modification of other users\u2019 messages (violation of data integrity)\n\n\n# Steps to Reproduce\n\n1. Log in as an administrator\n\n\u003cimg width=\"3334\" height=\"1668\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b20323d3-c050-4438-8912-193a417654bc\" /\u003e\n\n\n2. Create User A\n\n\u003cimg width=\"3346\" height=\"788\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b9e4fb8a-b14e-4a4b-b012-02ccfba52fca\" /\u003e\n\n3. Create User B\n\n\u003cimg width=\"3354\" height=\"796\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f3cf6892-e6c9-4778-b471-f1cc0deec6c8\" /\u003e\n\n\n4. Log in as User A\n\n\u003cimg width=\"3360\" height=\"1668\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5264ee07-f5c5-4bbe-ad4f-da69fb540fc9\" /\u003e\n\n\n5. Log in as User B\n\n\u003cimg width=\"3354\" height=\"1670\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f112f8e8-b3e2-4e65-b226-c7b6c986f3bb\" /\u003e\n\n\n6. As the administrator, create a new channel\n\n\u003cimg width=\"2582\" height=\"988\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bc012d9a-f884-4c83-b6bb-d1e5399f61bb\" /\u003e\n\n\n7. As User A, post a new message in the channel\n\n\u003cimg width=\"2626\" height=\"962\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d7ff12c2-fe17-44f0-aaf9-5ce2bac9a378\" /\u003e\n\n\n8. As User B, edit User A\u2019s message\n\n\u003cimg width=\"2604\" height=\"958\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8e19ec3e-fdda-4d36-acd5-f3e1fd3402dd\" /\u003e\n\n\n9. Confirm that User A\u2019s message has been modified without authorization\n\n\u003cimg width=\"2378\" height=\"1976\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6415fd41-ac68-4d42-83c9-6297caee1fb4\" /\u003e\n\n\n## Affected Files and Line Numbers\n\n- `backend/open_webui/routers/channels.py:1417\u20131460`\n    \n    The authorization check in `update_message_by_id` allows access with **read** permission\n    \n- `backend/open_webui/utils/access_control.py:124\u2013135`\n    \n    When `access_control=None` and `strict=True`, **read** access is permitted\n    \n- `backend/open_webui/models/messages.py:341\u2013358`\n    \n    The update logic does not enforce any message ownership check\n    \n\n## Recommended Mitigation\n\nUpdate the condition in\n\n`backend/open_webui/routers/channels.py:1451\u20131456`\n\nby changing the permission check from **`read`** to **`write`**, so that only administrators, message owners, or users with write permission can update messages.\n\n### Proposed Changes\n\n- For standard channels, change the update permission requirement from\n    \n    `has_access(..., type=\"read\")` to `has_access(..., type=\"write\")`\n    \n- Preserve the existing ownership check (`message.user_id == user.id`)\n\n## **AI Usage**\n\n- Translation from Japanese to English\n- CWE classification and assessment\n- Affected Files and Line Numbers",
  "id": "GHSA-jgj3-r8hr-9pjw",
  "modified": "2026-05-19T15:57:52Z",
  "published": "2026-05-11T14:05:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jgj3-r8hr-9pjw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44571"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI\u0027s Improper Authorization in Standard Channels Allows Message Updates with Read Permission"
}