{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/open-webui--0.9.5--0.10.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open WebUI (\u003e= 0.9.5, \u003c 0.10.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","web-application","api-abuse","authorization-bypass","ghsa","data-manipulation"],"_cs_type":"advisory","_cs_vendors":["Open WebUI"],"content_html":"\u003cp\u003eA high-severity authorization bypass vulnerability, tracked as CVE-2026-59714, has been identified in Open WebUI versions 0.9.5 through 0.9.x, prior to 0.10.0. This flaw allows any authenticated user to overwrite messages in arbitrary channels, including private and direct message channels, even if they are not a member of those channels. The vulnerability resides in the chat completion API, specifically when handling requests with a \u003ccode\u003echannel:\u003c/code\u003e-prefixed \u003ccode\u003echat_id\u003c/code\u003e and a target \u003ccode\u003emessage_id\u003c/code\u003e. This bypasses critical ownership and membership verification steps, leading to unchecked database writes that alter message content while retaining the original author's attribution. This issue results in message integrity destruction and enables impersonation, posing a significant risk to the trustworthiness and privacy of communications within affected Open WebUI instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated attacker sends a \u003ccode\u003ePOST\u003c/code\u003e request to the \u003ccode\u003e/api/chat/completions\u003c/code\u003e API endpoint.\u003c/li\u003e\n\u003cli\u003eThe request body includes a \u003ccode\u003echat_id\u003c/code\u003e parameter prefixed with \u003ccode\u003echannel:\u003c/code\u003e, for example, \u003ccode\u003echannel:any-channel-uuid-here\u003c/code\u003e, and a \u003ccode\u003emessage_id\u003c/code\u003e parameter corresponding to a specific message in a target victim channel.\u003c/li\u003e\n\u003cli\u003eWhen \u003ccode\u003emain.py\u003c/code\u003e processes the request with the \u003ccode\u003echannel:\u003c/code\u003e prefix, it incorrectly bypasses the standard ownership and membership verification checks for the channel.\u003c/li\u003e\n\u003cli\u003eThe user-supplied \u003ccode\u003emessage_id\u003c/code\u003e from the request body is passed directly to the \u003ccode\u003e_make_channel_emitter\u003c/code\u003e function in \u003ccode\u003esocket/main.py\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e_make_channel_emitter\u003c/code\u003e function then calls \u003ccode\u003eMessages.update_message_by_id\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eMessages.update_message_by_id\u003c/code\u003e executes a direct primary-key database update using the attacker-provided \u003ccode\u003emessage_id\u003c/code\u003e without performing any additional channel ID or user authorization validation.\u003c/li\u003e\n\u003cli\u003eThe content of the targeted message in the victim's channel is overwritten with attacker-controlled content.\u003c/li\u003e\n\u003cli\u003eThe overwritten message retains the original author's attribution, allowing the attacker to impersonate the legitimate sender.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-59714 allows any authenticated user to unilaterally overwrite messages in any channel they do not belong to, including private channels and direct messages. This leads to a severe degradation of message integrity and enables sophisticated impersonation attacks, as the altered messages still appear to originate from their original authors. This could be used for spreading misinformation, issuing false instructions, or compromising the privacy and trust within an organization's communication platform. While the advisory does not specify the number of victims or sectors targeted, any organization utilizing vulnerable versions of Open WebUI is at risk of such communication integrity breaches.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Open WebUI instances immediately to version \u003ccode\u003e0.10.0\u003c/code\u003e or later to remediate CVE-2026-59714.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/api/chat/completions\u003c/code\u003e containing a \u003ccode\u003echat_id\u003c/code\u003e parameter that starts with \u003ccode\u003echannel:\u003c/code\u003e, especially if the request is not from expected sources or user roles.\u003c/li\u003e\n\u003cli\u003eImplement WAF or API gateway rules to inspect the JSON body of \u003ccode\u003ePOST /api/chat/completions\u003c/code\u003e requests for the \u003ccode\u003echat_id\u003c/code\u003e field containing \u003ccode\u003echannel:\u003c/code\u003e and the \u003ccode\u003emessage_id\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eReview access logs and internal audit trails for any \u003ccode\u003ePOST\u003c/code\u003e requests to the \u003ccode\u003ehttp://target:8080/api/chat/completions\u003c/code\u003e endpoint that occurred on affected versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T17:05:26Z","date_published":"2026-07-24T17:05:26Z","id":"https://feed.craftedsignal.io/briefs/2026-07-open-webui-channel-overwrite/","summary":"An authenticated user can overwrite messages in any channel, including private and DM channels, by exploiting the CVE-2026-59714 authorization bypass vulnerability in Open WebUI's chat completion API, leading to message integrity destruction and impersonation.","title":"Open WebUI Cross-Channel Message Overwrite Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-open-webui-channel-overwrite/"}],"language":"en","title":"CraftedSignal Threat Feed - Open WebUI (\u003e= 0.9.5, \u003c 0.10.0)","version":"https://jsonfeed.org/version/1.1"}