CVE-2026-45385: Open WebUI IDOR in Channels message update function

Executive brief

Open WebUI, a user interface for interacting with large language models, contains a flaw in its messaging system. This vulnerability allows any member of a group chat or direct message to edit or change messages sent by other users, including administrators. This could be used by malicious actors to spread misinformation or alter the history of a conversation within the platform.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `update_message_by_id` API endpoint within the Channels feature of Open WebUI. The root cause is a missing ownership check in the `backend/open_webui/routers/channels.py` file for 'group' or 'dm' channel types; the code only verifies that the requesting user is a member of the channel, not that they authored the specific message. An authenticated attacker who is a member of a channel can send a crafted POST request to the update endpoint to modify any message ID within that channel, including those from administrators. This issue is resolved in version 0.9.5.

Affected products

• Open WebUI Open WebUI < 0.9.5

Timeline

• 2026-05-10: disclosed
• 2026-05-14: advisory
• 2026-05-14: patched: Version 0.9.5 released

References

• https://api.github.com/users/kikayli
• https://github.com/kikayli
• https://api.github.com/users/kikayli/gists%7B/gist_id%7D
• https://api.github.com/users/kikayli/repos
• https://avatars.githubusercontent.com/u/205863854?v=4
• https://api.github.com/users/kikayli/events%7B/privacy%7D