CVE-2026-44571: Open WebUI Auth Bypass Vulnerability

CVE-2026-44571 Overview

CVE-2026-44571 is a missing authorization vulnerability [CWE-862] affecting Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. Versions prior to 0.8.6 allow authenticated users with read-only permissions to modify messages owned by other users in standard channels. The flaw resides in the POST /api/v1/channels/{channel_id}/messages/{message_id}/update endpoint. When access_control is set to None, the authorization check has_access(..., type="read") returns True for any user with read access, bypassing message ownership validation. Open WebUI released a fix in version 0.8.6.

Critical Impact

Authenticated users can modify other users' messages in standard channels, compromising integrity of conversational data.

Affected Products

• Open WebUI versions prior to 0.8.6
• Self-hosted Open WebUI deployments using standard channels (non-group, non-DM)
• Open WebUI instances configured with access_control set to None

Discovery Timeline

• 2026-05-15 - CVE-2026-44571 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-44571

Vulnerability Analysis

The vulnerability stems from an improper authorization check in the message update endpoint. Open WebUI exposes POST /api/v1/channels/{channel_id}/messages/{message_id}/update to allow users to edit messages within channels. In standard channels, where channel.type is neither group nor dm, the endpoint relies solely on the channel-level has_access function to determine whether a caller may perform the update.

When the channel's access_control property is set to None, the access function evaluates has_access(..., type="read") as True for any authenticated user with channel visibility. The endpoint does not verify that the caller is the original author of the target message. This allows any user with read access to invoke the update operation against messages they do not own.

The result is unauthorized modification of message content belonging to other users. The integrity impact is high, while confidentiality and availability remain unaffected, consistent with the CWE-862 classification.

Root Cause

The root cause is missing ownership validation in the message update handler. The application conflates channel-level read access with message-level write authorization. A correct implementation must verify that the authenticated user identity matches the user_id field of the target message before applying changes.

Attack Vector

An attacker requires an authenticated account with read access to a standard channel containing the target message. The attacker sends a crafted POST request to the update endpoint, supplying the victim message ID and new content. The server applies the change without ownership validation. Exploitation is achievable over the network with low complexity and low privileges, and requires no user interaction.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the GitHub Security Advisory GHSA-jgj3-r8hr-9pjw for vendor details.

Detection Methods for CVE-2026-44571

Indicators of Compromise

• Unexpected modifications to channel messages where the editing user differs from the original author
• HTTP POST requests to /api/v1/channels/{channel_id}/messages/{message_id}/update from accounts that do not match the message owner
• Audit log entries showing message edits without corresponding ownership context

Detection Strategies

• Compare the authenticated user ID in request logs against the user_id of the message referenced in the update URL path
• Alert on bulk or repeated messages/{message_id}/update calls originating from a single account against multiple message IDs
• Review channel configurations for access_control set to None and correlate with update activity

Monitoring Recommendations

• Enable verbose request logging on the Open WebUI reverse proxy to capture full URL paths and authenticated identities
• Monitor message integrity by snapshotting message content and detecting unauthorized after-the-fact edits
• Track the Open WebUI version deployed across infrastructure and flag any instance running below 0.8.6

How to Mitigate CVE-2026-44571

Immediate Actions Required

• Upgrade all Open WebUI instances to version 0.8.6 or later without delay
• Inventory all standard channels with access_control set to None and apply stricter access controls until patching is complete
• Audit recent message modifications in standard channels to identify potential unauthorized edits

Patch Information

The vulnerability is fixed in Open WebUI version 0.8.6. Administrators should pull the updated container image or release artifact and redeploy. Refer to the GitHub Security Advisory GHSA-jgj3-r8hr-9pjw for the official remediation guidance.

Workarounds

• Restrict standard channels by setting explicit access_control policies rather than leaving the value as None
• Limit standard channel membership to trusted users until the upgrade is applied
• Consider temporarily disabling standard channels and routing communications through group or direct message channels, which are not affected

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.8.6
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.8.6