CVE-2026-59714

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.9.9

Description An authenticated user can overwrite the content of messages in channels they do not belong to, including private and direct message channels. This occurs when a chat completion request is sent to the /api/chat/completions endpoint with a chat id prefixed with channel:. The system fails to properly verify channel membership and ownership, allowing the make channel emitter() function to update the Messages table using a user-supplied message id without validating if the message belongs to the specified channel. This can lead to message integrity destruction and impersonation, as the overwritten message retains the original author's attribution while displaying content chosen by the attacker. The issue involves the chat id, id, and message ids variables.

Recommendations Update to version 0.10.0 or later. As a temporary mitigation, restrict the use of the channel: prefix in the chat id parameter when calling the /api/chat/completions endpoint.