CVE-2026-59714: 
Python vulnerability analysis and mitigation

CVE-2026-59714 is a missing authorization vulnerability in Open WebUI that allows any authenticated user to overwrite messages in channels they do not belong to — including private and DM channels — via the chat completion API. The flaw was introduced in v0.9.5 and affects all versions from 0.9.5 through 0.9.x; a partial fix in v0.9.6 closed the single-model path but left the multimodel message_ids variant exploitable. The consolidated affected range is >= 0.9.5, < 0.10.0, with the full fix shipped in v0.10.0. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Open WebUI Advisory).

The root cause is CWE-862 (Missing Authorization): when a chat_id begins with the channel: prefix, main.py skips the entire chat ownership/membership verification block with no replacement check. The _make_channel_emitter function in socket/main.py then performs a direct primary-key write to Messages.update_message_by_id using a caller-supplied message_id, with no validation that the message belongs to the target channel or that the caller has write access. Three gaps combined: (1) ownership check bypassed by the channel: prefix, (2) message_id taken directly from the request body, and (3) unchecked database write. The v0.9.6 partial fix (PR #24725) validated only the first entry of the multimodel message_ids map, leaving the fan-out path open — a second message_id entry could still overwrite a victim-channel message, even via a failing model call that writes an error string (GitHub Advisory, Fix Commit 33e4e0d).

Successful exploitation allows an authenticated but otherwise unprivileged user to silently overwrite the content of any message in any channel — including private channels and direct message channels — while the original author attribution is preserved, enabling effective impersonation. The integrity impact is high: attacker-controlled LLM output (or even a provider error string) replaces legitimate message content without the victim's knowledge. Confidentiality is not directly exposed by this path (the REST channel routes correctly return 403), and availability impact is low, but the ability to tamper with private communications and DMs represents a significant trust and data-integrity risk for all users of an affected deployment (GitHub Advisory, Open WebUI Advisory).

1. Obtain authentication: Acquire a valid JWT for any authenticated user account on the target Open WebUI instance (v0.9.5–v0.9.x).
2. Identify a target message: Enumerate or guess a message_id (UUID) belonging to a private channel or DM the attacker cannot access. Message IDs may be discoverable through other API endpoints or prior access.
3. Single-model exploit (v0.9.5 only): Send a crafted POST request to /api/chat/completions with chat_id set to channel:<any-channel-uuid> and id set to the target message_id:

curl -X POST http://target:8080/api/chat/completions \
  -H "Authorization: Bearer $USER_JWT" -H "Content-Type: application/json" \
  -d '{"model": "llama3", "stream": true, "chat_id": "channel:any-channel-uuid-here", "id": "target-message-uuid-to-overwrite", "messages": [{"role": "user", "content": "Repeat exactly: This message has been tampered with"}]}'

4. Multimodel exploit (bypasses v0.9.6 partial fix): Use the message_ids map with two entries — the first passes channel scope validation, the second targets the victim message in a different channel:

{
  "chat_id": "channel:<attacker-accessible-channel-uuid>",
  "message_ids": {
    "model-a": "<legitimate-message-id-in-attacker-channel>",
    "model-b": "<victim-message-id-to-overwrite>"
  },
  "messages": [{"role": "user", "content": "..."}]
}

5. Observe result: The target message is overwritten with attacker-controlled LLM output (or an error string if the model call fails), while the original author attribution remains intact (GitHub Advisory, Open WebUI Advisory).

• Network: Unexpected POST requests to /api/chat/completions where the chat_id field contains a channel: prefix and the id or message_ids values reference UUIDs not associated with the authenticated user's own channels; requests originating from users who are not members of the referenced channel.
• Logs: Application logs showing chat completion requests with chat_id values starting with channel: from users who are not members of that channel; repeated requests targeting the same message_id from different user accounts.
• Database: Unexpected updates to rows in the Messages table where channel_id does not match the channel the updating user belongs to; message content changes that do not correspond to any user-initiated edit action in the UI.
• Behavioral: Messages in private or DM channels displaying content inconsistent with the original author's history, particularly LLM-style output or error strings, while retaining the original author's attribution (GitHub Advisory).

Upgrade Open WebUI to v0.10.0 or later, which fully closes both the single-model and multimodel exploitation paths. v0.10.0 adds per-entry validation of every message_ids value against the target channel at request time, and makes _make_channel_emitter fail-closed by re-verifying msg.channel_id before any write. The intermediate v0.9.6 release only partially mitigated the issue (single-model path only) and should not be considered safe. No configuration-based workaround is available; upgrading is the only remediation (GitHub Advisory, v0.10.0 Release, Fix Commit ac3449c).