CVE-2026-44569: Open WebUI Auth Bypass Vulnerability

CVE-2026-44569 Overview

CVE-2026-44569 is an Insecure Direct Object Reference (IDOR) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate fully offline. Versions prior to 0.6.19 expose message update and delete endpoints in the channels subsystem that enforce channel-level authorization but omit message ownership checks. Authenticated users with read access to a channel can modify or delete any message in that channel, including messages owned by other users or administrators. The frontend correctly hides edit and delete controls based on ownership, but attackers can bypass the client-side controls by calling the backend APIs directly. The issue is fixed in version 0.6.19.

Critical Impact

Authenticated users can tamper with or destroy other users' channel messages, undermining message integrity and audit trails in shared Open WebUI deployments.

Affected Products

• Open WebUI versions prior to 0.6.19
• Self-hosted Open WebUI deployments using the channels feature
• Multi-user Open WebUI instances where read access is granted to non-owners

Discovery Timeline

• 2026-05-15 - CVE-2026-44569 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-44569

Vulnerability Analysis

The vulnerability is a Missing Authorization weakness [CWE-862] in the channels message management APIs of Open WebUI. The message update and delete endpoints validate that the caller has access to the containing channel but do not verify that the caller owns the target message. The frontend UI only displays edit and delete affordances when the current user owns the message or is an administrator, which creates the appearance of proper authorization. Because the enforcement lives in the client, an attacker can craft direct HTTP requests to the backend and bypass the visual restriction entirely. The result is a client-side security control bypass that lets any channel member alter or delete arbitrary messages in that channel.

Root Cause

The backend handlers for message updates and deletions implement only channel-scope authorization. They do not compare the authenticated user's identity against the user_id field of the target message before performing the write. Ownership enforcement was implemented exclusively in the frontend, leaving the API contract unprotected.

Attack Vector

Exploitation requires only an authenticated account with read access to a channel. The attacker identifies a target message ID by reading channel content, then issues a direct API call to the update or delete endpoint with that message ID. No special privileges, social engineering, or user interaction are required. See the Open WebUI GitHub Security Advisory GHSA-jxwr-g6r6-j3fx for vendor-published technical details.

Detection Methods for CVE-2026-44569

Indicators of Compromise

• Channel messages whose content changes without a corresponding edit action from the original author in application logs.
• Message delete operations recorded against accounts that do not own the deleted message and are not administrators.
• API requests to channel message update or delete endpoints from clients that did not previously load the target message via the UI.

Detection Strategies

• Correlate message_id values in update and delete API calls against the stored user_id of the message and the caller's identity to flag mismatches.
• Alert on bursts of message modification or deletion events originating from a single authenticated session across multiple message owners.
• Review reverse proxy or application access logs for direct calls to message management endpoints that bypass normal UI navigation patterns.

Monitoring Recommendations

• Enable verbose audit logging for channel message create, update, and delete operations, including caller user ID and message owner ID.
• Forward Open WebUI application logs to a centralized log platform and retain them long enough to investigate suspected tampering.
• Periodically reconcile message edit history with expected author activity to detect silent modifications.

How to Mitigate CVE-2026-44569

Immediate Actions Required

• Upgrade all Open WebUI instances to version 0.6.19 or later without delay.
• Audit channel membership and remove read access for users who do not require it, reducing the pool of potential abusers.
• Review recent channel message edit and delete events for activity inconsistent with the apparent author.

Patch Information

The vulnerability is fixed in Open WebUI 0.6.19. The fix adds message ownership validation to the update and delete endpoints so that backend authorization matches the frontend ownership checks. Administrators should obtain the release from the official Open WebUI repository and follow vendor upgrade procedures referenced in the GitHub Security Advisory GHSA-jxwr-g6r6-j3fx.

Workarounds

• Restrict channel read access to trusted users until the upgrade to 0.6.19 is complete.
• Disable the channels feature for multi-tenant deployments where untrusted users share channels, if upgrading is not immediately feasible.
• Place Open WebUI behind a reverse proxy that blocks or logs direct calls to message update and delete endpoints from unexpected sources.

# Verify the running Open WebUI version and upgrade via container image
docker exec open-webui cat /app/backend/VERSION
docker pull ghcr.io/open-webui/open-webui:0.6.19
docker stop open-webui && docker rm open-webui
# Re-create the container using your existing volumes and 0.6.19 image