Information disclosure in Open WebUI - CVE-2026-59222
Published: July 3, 2026
Vulnerability identifier: #VU136850
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59222
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the /api/v1/channels/{id}/members endpoint when handling requests for channel member listings. A remote user can send a request to the endpoint as a channel participant to disclose sensitive information.
Only instances with channels enabled are vulnerable. The endpoint returns full serialized user models for channel participants, including settings data such as webhook URLs and tool server key material.
Affected software
Open WebUI
How to mitigate CVE-2026-59222
Install security update from vendor's website.
Open WebUI - update to 0.10.0