CVE-2026-45385: Open WebUI Auth Bypass Vulnerability

CVE-2026-45385 Overview

CVE-2026-45385 is an Insecure Direct Object Reference (IDOR) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw resides in the Channels feature and affects all versions prior to 0.9.5. Any authenticated channel member can modify messages posted by other members within the same channel, including messages authored by administrators. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and is fixed in version 0.9.5.

Critical Impact
Authenticated channel members can tamper with messages from any other member, including administrators, breaking message integrity and enabling impersonation of authoritative content within shared channels.

Affected Products

Open WebUI versions prior to 0.9.5
Deployments using the Channels feature with group or direct message (DM) channel types
Self-hosted Open WebUI instances exposing multi-user collaboration

Discovery Timeline

2026-05-15 - CVE-2026-45385 published to the National Vulnerability Database (NVD)
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-45385

Vulnerability Analysis

The vulnerability exists in the update_message_by_id function within the Channels feature of Open WebUI. When the function handles message updates for group or dm channel types, it performs only a membership check against the requesting user. The check confirms that the caller belongs to the channel via the is_user_channel_member function. The function does not validate that the caller authored the message being modified.

Because message ownership is never verified, any authenticated user who shares a channel with a target can issue an update request against an arbitrary message identifier. The server accepts the update and overwrites the original content. This breaks the implicit trust model of chat channels, where messages are expected to reflect their stated author.

Root Cause

The root cause is missing object-level authorization on the message update endpoint. The handler conflates two distinct authorization concerns: channel membership and message ownership. Membership grants read and post capabilities, but it should not grant write access to objects owned by other principals. This pattern aligns with [CWE-639], where access control decisions rely on a user-supplied identifier without verifying that the identifier belongs to the requester.

Attack Vector

Exploitation requires only network access to the Open WebUI instance and valid credentials for a user who shares a channel with the victim. The attacker enumerates or observes the target message identifier, then submits an update request referencing that identifier. No elevated privileges, social engineering, or user interaction is required. The Exploit Prediction Scoring System (EPSS) probability is low, and no public exploit code or CISA KEV entry is associated with this CVE.

The vulnerability mechanism is described in prose above; no verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-wwhq-cx22-f7vv for vendor details.

Detection Methods for CVE-2026-45385

Indicators of Compromise

Audit log entries showing message edits where the editing user identifier differs from the original message author identifier within the same channel.
Unexpected modifications to administrator-authored messages in group or dm channels.
Repeated PUT or PATCH requests to channel message update endpoints originating from a single low-privilege account.

Detection Strategies

Review application logs for calls to update_message_by_id and correlate the acting user with the original user_id field of the target message.
Alert on message edits performed by users other than the original author, particularly when the original author holds administrative roles.
Establish a baseline of normal message-edit behavior per user and flag deviations such as bulk edits across multiple authors.

Monitoring Recommendations

Enable verbose audit logging on Open WebUI API endpoints handling channel messages and forward logs to a centralized SIEM.
Monitor authentication patterns for channel members who suddenly interact with messages outside their normal activity scope.
Track Open WebUI version metadata across deployments to identify instances still running versions prior to 0.9.5.

How to Mitigate CVE-2026-45385

Immediate Actions Required

Upgrade Open WebUI to version 0.9.5 or later on all self-hosted instances.
Review channel membership lists and remove untrusted or unnecessary members from sensitive group channels.
Inspect message history in administrative channels for unauthorized modifications since deployment.

Patch Information

The maintainers fixed the issue in Open WebUI 0.9.5 by adding message ownership verification within the update_message_by_id function. Administrators should pull the patched release from the official Open WebUI repository. Refer to the GitHub Security Advisory GHSA-wwhq-cx22-f7vv for full remediation guidance.

Workarounds

Restrict access to the Channels feature by limiting channel membership to trusted users until the patch is applied.
Place Open WebUI behind an authenticating reverse proxy that enforces stricter access policies on message update endpoints.
Disable group and DM channel usage in environments where upgrading to 0.9.5 cannot be completed immediately.

bash

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.9.5
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.9.5