CVE-2026-87994— Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Quick assessment
Affected
open-webui open-webui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Open WebUI 是一个可扩展、功能丰富且用户友好的自托管 AI 平台。从版本 0.9.5 到 0.11.1，位于 中 的 channel 分支在处理给定的 时，检查了频道的写入权限和成员身份，但未验证调用者是否为目标消息的作者。因此，频道成员可以通过 chat completions 端点替换其他成员的消息，同时保留受害者作为存储的作者，从而在不获取其他频道访问权限的情况下修改会话记录。该问题已在版本 0.11.1 中修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87994
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id but did not verify that the calling user authored the targeted message. A channel member could use the chat completions endpoint to replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. This issue is fixed in version 0.11.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-webui | open-webui | >= 0.9.5, < 0.11.1 | - |
|
II. Public POCs for CVE-2026-87994
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87994
请登录查看更多情报信息。
Other References for CVE-2026-87994 (2)
Same Patch Batch · open-webui · 2026-09-09 · 16 CVEs total
| CVE-2026-87995 | 8.7 HIGH | Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcodin |
| CVE-2026-87016 | 8.1 HIGH | Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on |
| CVE-2026-87996 | 7.7 HIGH | Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader |
| CVE-2026-87011 | 7.5 HIGH | Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in bac |
| CVE-2026-87998 | 7.1 HIGH | Open WebUI: Non-admin users can delete admin-owned external knowledge connections via know |
| CVE-2026-87999 | 7.1 HIGH | Open WebUI: Any authenticated user can reach the Azure platform channel via server-side we |
| CVE-2026-87015 | 6.8 MEDIUM | Open WebUI: A user's session cookies are sent to tool servers configured for bearer authen |
| CVE-2026-87014 | 6.5 MEDIUM | Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' |
| CVE-2026-88000 | 6.5 MEDIUM | Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic ch |
| CVE-2026-88002 | 6.5 MEDIUM | Open WebUI: Any authenticated user can hang the server via a cyclic chat message history |
| CVE-2026-88001 | 5.0 MEDIUM | Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redi |
| CVE-2026-87012 | 4.3 MEDIUM | Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-nu |
| CVE-2026-87013 | 4.3 MEDIUM | Open WebUI: Any authenticated user can start a non-terminating request via a folder parent |
| CVE-2026-87017 | 4.3 MEDIUM | Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool o |
| CVE-2026-87997 | 4.3 MEDIUM | Open WebUI: Any authenticated user can inject chats into another user's folder via chat co |
IV. Related Vulnerabilities
Same product: open-webui
-
CVE-2026-88002
Open WebUI: Any authenticated user can hang the server via a -
CVE-2026-88001
Open WebUI: Server-side fetches reach blocked and internal h -
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via m -
CVE-2026-87999
Open WebUI: Any authenticated user can reach the Azure platf -
CVE-2026-87998
Open WebUI: Non-admin users can delete admin-owned external
Same vendor: open-webui
-
CVE-2026-88002
Open WebUI: Any authenticated user can hang the server via a -
CVE-2026-88001
Open WebUI: Server-side fetches reach blocked and internal h -
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via m -
CVE-2026-87999
Open WebUI: Any authenticated user can reach the Azure platf -
CVE-2026-87998
Open WebUI: Non-admin users can delete admin-owned external
Same weakness: CWE-639
-
CVE-2026-87997
Open WebUI: Any authenticated user can inject chats into ano -
CVE-2026-67403
Cash Collect API跨租户授权缺陷 -
CVE-2026-86763
snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Impor -
CVE-2026-86761
snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print e -
CVE-2026-86743
Snipe-IT before 8.7.0 Authorization Bypass via Asset Accepta
V. Comments for CVE-2026-87994
No comments yet