CVE-2026-87994: Open WebUI Authentication Bypass Vulnerability

CVE-2026-87994 Overview

CVE-2026-87994 is a broken access control vulnerability [CWE-639] in Open WebUI, a self-hosted AI platform. Affected versions from 0.9.5 up to (but not including) 0.11.1 fail to verify message authorship in the channel branch of chat_completion within backend/open_webui/main.py. A channel member with write access can invoke the chat completions endpoint to overwrite another member's message while preserving the original author on the record. The flaw allows silent tampering with channel conversation history without granting access to other channels. Open WebUI resolved the issue in version 0.11.1.

Critical Impact
Authenticated channel members can modify other users' messages, corrupting conversation integrity and audit records within shared channels.

Affected Products

Open WebUI 0.9.5 through 0.11.0
Fixed in Open WebUI 0.11.1
Component: backend/open_webui/main.py (chat_completion channel branch)

Discovery Timeline

2026-09-09 - CVE-2026-87994 published to NVD
2026-09-09 - Last updated in NVD database
Fix released - Open WebUI v0.11.1 addresses the flaw via pull request #28631

Technical Details for CVE-2026-87994

Vulnerability Analysis

Open WebUI exposes a chat_completion endpoint that accepts a chat_id and a target message_id. When the chat_id is prefixed with channel:, the request is routed to a channel branch that generates or updates a message tied to the channel record. The pre-patch logic enforced two checks: the caller must hold write access on the target channel, and the supplied message_id must belong to that channel. It never verified that the caller was the original author of the referenced message. Any authenticated channel member could therefore replace another member's stored message content while the persisted author field continued to point at the victim.

Root Cause

The root cause is a missing authorization check on message ownership, classified as Authorization Bypass Through User-Controlled Key [CWE-639]. The channel gate aligned on channel membership rather than message authorship, diverging from the stricter check enforced by the separate message update route. The fix in commit 7d392be aligns the channel completion gate with the message update route so that the caller must own the targeted message.

Attack Vector

Exploitation requires network access to the Open WebUI instance and valid credentials for a channel with write permissions. The attacker submits a chat_completion request that references another member's message_id in the same channel. The server writes updated content while leaving the victim listed as the message author, producing a forged conversation record. No user interaction is required from the victim, and the scope of tampering is limited to channels the attacker already belongs to.

python

         if metadata.get('chat_id') and user:
             chat_id = metadata['chat_id']
 
-            # Gate channel: branch — caller needs write access on the channel
-            # and the supplied message_id must belong to that channel.
+            # Gate channel: branch — caller needs write access on the channel, and the
+            # supplied message_id must belong to that channel and be the caller's own.
             if chat_id.startswith('channel:'):
                 channel_id = chat_id.removeprefix('channel:')
                 channel = await Channels.get_channel_by_id(channel_id)

Source: Open WebUI commit 7d392be. The patch adds an authorship check so callers can only trigger completions against messages they authored.

Detection Methods for CVE-2026-87994

Indicators of Compromise

Channel messages whose stored content diverges from prior audit snapshots while retaining the original author identifier.
chat_completion API requests where the authenticated user identifier does not match the author of the referenced message_id.
Unexpected edit timestamps or content revisions on channel messages with no corresponding user-driven edit event.

Detection Strategies

Enable verbose application logging for the chat_completion endpoint and correlate the acting user identity with the target message_id owner.
Compare historical database snapshots of channel messages to detect content mutations that were not produced by the recorded author.
Deploy anomaly rules that alert when a channel member issues completions referencing message IDs authored by other users.

Monitoring Recommendations

Forward Open WebUI application and reverse-proxy access logs to a centralized analytics platform for retention and correlation.
Track version metadata of deployed Open WebUI instances to identify any hosts still running 0.9.5 through 0.11.0.
Baseline normal channel activity per user and alert on spikes in message edits or completion calls that touch other authors' content.

How to Mitigate CVE-2026-87994

Immediate Actions Required

Upgrade all Open WebUI deployments to version 0.11.1 or later, which enforces message authorship in the channel completion path.
Audit channel membership and revoke write access from accounts that do not require it while patching is scheduled.
Review recent channel message history for unexpected modifications and restore authoritative content from backups where tampering is confirmed.

Patch Information

The fix is delivered in Open WebUI v0.11.1 via commit 7d392be and pull request #28631. Full advisory details are published in GHSA-fmqh-xp37-5hr8. The patch aligns the channel chat_completion authorization gate with the message update route so only the original author of a message can trigger a completion against it.

Workarounds

Restrict channel write access to a minimal, trusted user set until the upgrade to 0.11.1 is deployed.
Disable or gate the channels feature behind a reverse-proxy access control list for untrusted users.
Retain immutable off-platform backups of channel conversation records to support forensic reconstruction if tampering occurs.

bash

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:v0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.1

# Verify the running version
curl -s http://localhost:3000/api/version