Missing Authorization in Open WebUI - #VU140750
Published: August 3, 2026
Vulnerability identifier: #VU140750
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify or delete other users' messages in a standard channel.
The vulnerability exists due to missing authorization in update_message_by_id and delete_message_by_id in backend/open_webui/routers/channels.py when handling update and delete requests for standard-channel messages. A remote user can send crafted requests referencing another member's message ID to modify or delete other users' messages in a standard channel.
Only standard channels are affected, and channels must be enabled. Group and direct message channels are not affected.
Affected software
Open WebUI
Remediation
Install security update from vendor's website.
Open WebUI - update to 0.11.0