CVE-2026-70481: Open WebUI Auth Bypass Vulnerability

CVE-2026-70481 Overview

CVE-2026-70481 is a broken access control vulnerability [CWE-284] in Open WebUI, an extensible self-hosted AI platform. The flaw affects versions from 0.5.0 up to (but not including) 0.11.0. The standard channel message update and delete handlers accepted any caller holding write access on the channel without verifying that the caller actually authored the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant's message. Group and direct message handlers correctly enforced authorship and were not affected. The issue is fixed in release 0.11.0.

Critical Impact
Any authenticated member of a shared standard channel can tamper with or delete other users' messages, undermining message integrity and audit trails in collaborative AI workspaces.

Affected Products

Open WebUI versions 0.5.0 through 0.10.x
Open WebUI standard channel message update handler
Open WebUI standard channel message delete handler

Discovery Timeline

2026-08-04 - CVE-2026-70481 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70481

Vulnerability Analysis

The vulnerability resides in the standard channel message handlers within backend/open_webui/routers/channels.py. The authorization logic conflated two distinct concepts: channel write permission and message authorship. When a caller attempted to edit or delete a message, the handler checked only that the caller held write access on the channel or was the message author, allowing either condition to satisfy the check. Because posting to a channel already requires write access, every legitimate participant satisfied the permission branch. This gave any channel member the ability to modify or delete messages authored by other members. The direct and group message handlers used stricter authorship checks and were not vulnerable. The fix separates the two checks: write access governs whether the caller may interact with the channel, while a subsequent authorship check governs whether the caller may modify a specific message.

Root Cause

The root cause is an incorrect authorization predicate that treated write permission on a channel as equivalent to authorship of an individual message. The and logic between message.user_id != user.id and channel_has_access(..., permission='write') produced a permissive result: a non-author with write access bypassed the intended restriction on cross-member edits.

Attack Vector

An authenticated low-privileged user who is a member of a shared standard channel sends an authenticated HTTP request to the message update or delete endpoint, targeting a message_id written by another user. The server validates channel write access, finds it present, and applies the requested change. No user interaction from the victim is required.

python

# Patch from backend/open_webui/routers/channels.py
# Source: https://github.com/open-webui/open-webui/commit/c609ec41154fa092fa0af80d9d365de06b666286

        if user.role != 'admin' and message.user_id != user.id:
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT())
    else:
-        if (
-            user.role != 'admin'
-            and message.user_id != user.id
-            and not await channel_has_access(user.id, channel, permission='write', strict=False, db=db)
+        if user.role != 'admin' and not await channel_has_access(
+            user.id, channel, permission='write', strict=False, db=db
        ):
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT())
+        # Write access is not authorship — block cross-member edits.
+        if user.role != 'admin' and message.user_id != user.id:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=ERROR_MESSAGES.DEFAULT())

    try:
        await Messages.update_message_by_id(message_id, form_data, db=db)

The patch splits the compound condition into two sequential checks, ensuring that write access authorizes channel interaction while a separate check enforces message authorship.

Detection Methods for CVE-2026-70481

Indicators of Compromise

HTTP POST or DELETE requests to Open WebUI channel message endpoints where the authenticated user_id differs from the target message's original user_id.
Unexpected update_message_by_id or delete_message_by_id audit records referencing messages authored by other users.
User reports of altered or missing messages in shared standard channels.

Detection Strategies

Enable and review Open WebUI application logs for message update and delete operations, correlating the acting user identifier with the original message author.
Query the messages database for updated_at timestamps that postdate the original created_at and compare against the acting principal recorded in audit logs.
Deploy application-layer monitoring to flag repeated cross-author edits within short time windows in the same channel.

Monitoring Recommendations

Instrument reverse proxies fronting Open WebUI to log request paths matching /api/*/channels/*/messages/* alongside authenticated session identity.
Alert on any 200 responses to message mutation endpoints where the acting user is not the original author and is not an administrator.
Track deployed Open WebUI versions across the environment and alert on any instance running a release earlier than 0.11.0.

How to Mitigate CVE-2026-70481

Immediate Actions Required

Upgrade all Open WebUI deployments to version 0.11.0 or later, which contains the authorship enforcement fix.
Inventory shared standard channels and notify participants that message history may have been altered while running an affected release.
Restrict standard channel membership to trusted users until upgrades are complete.

Patch Information

The fix is delivered in Open WebUI 0.11.0 via commit c609ec4 and pull request #27197. The change enforces authorship separately from channel write access in the standard channel message update and delete handlers. See the Open WebUI Security Advisory GHSA-mj5r-jf49-m3w7, the patch commit c609ec4, and the Open WebUI v0.11.0 release notes.

Workarounds

Reduce channel membership in shared standard channels to only administrators and highly trusted users until the upgrade is applied.
Disable or hide standard channel features by adjusting role-based access so non-admin users cannot join shared standard channels.
Enable database-level auditing on the messages table to preserve a tamper-evident record of edits and deletions.

bash

# Verify installed Open WebUI version and upgrade via pip
pip show open-webui | grep -i version
pip install --upgrade "open-webui>=0.11.0"

# Or upgrade the container image
docker pull ghcr.io/open-webui/open-webui:v0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.0