Executive brief
Open WebUI, a user interface for interacting with large language models, contains a flaw where private channel member lists can be viewed by unauthorized users. An authenticated user who knows the unique identifier of a private channel can retrieve the names, emails, and roles of all members in that channel. This could lead to the exposure of organizational structures and facilitate targeted social engineering attacks.
Technical details
A missing authorization check (CWE-862) exists in the `get_channel_members_by_id` function within `backend/open_webui/routers/channels.py`. While the endpoint correctly validates membership for 'group' and 'dm' channel types, it fails to call `channel_has_access` for 'standard' channels. An authenticated attacker with knowledge of a private channel's UUID can perform a GET request to `/api/v1/channels/{id}/members` to retrieve sensitive user data, including IDs, names, emails, roles, and profile images. This vulnerability is present in versions up to 0.8.12 and is fixed in version 0.9.0.
Affected products
- Open WebUI open-webui <= 0.8.12
Timeline
- 2026-05-05: disclosed
- 2026-05-08: advisory
- 2026-05-15: patched: NVD publication and patch confirmation for 0.9.0