CVE-2026-87994

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0

Description An issue exists in the channel branch of the chat completions handler where the system verifies if a user has write access to a channel and if a specific message belongs to that channel, but fails to verify if the calling user is the actual author of the message. This allows a channel member to use the /api/chat/completions endpoint to replace the content of another member's message using the id parameter. The replaced message retains the original author's identity, leading to a loss of integrity and non-repudiation as the conversation record is altered to attribute text to a victim who did not write it.

This issue only affects deployments where channels are enabled via the ENABLE CHANNELS variable. The attacker must have write access to the target channel and know the id of the message they wish to modify.

Recommendations Update Open WebUI to version 0.11.1. As a temporary mitigation, disable the channel feature by setting ENABLE CHANNELS to False.