SB2026110481 - Insufficient verification of data authenticity in Open WebUI

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110481

SB2026110481 - Insufficient verification of data authenticity in Open WebUI

Published: November 4, 2026

Security Bulletin ID SB2026110481
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to spoof a trusted channel webhook's identity in displayed messages.

The vulnerability exists due to insufficient verification of client-supplied metadata in the channel message post and edit endpoints in backend/open_webui/routers/channels.py when processing message submissions and edits. A remote user can submit messages containing metadata that identifies an existing channel webhook, using write access to the channel, to make their messages appear under the webhook's name and role in channel and pinned message lists.

Exploitation requires channels to be enabled through ENABLE_CHANNELS, which is disabled by default, and at least one webhook in the channel. The stored message author remains the submitting user's account; exploitation does not grant access to the webhook token or allow modification of the webhook's actual messages.


Remediation

Install update from vendor's website.

References