CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Authenticated users can overwrite messages in private channels they do not belong to by manipulating chat completion API parameters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59714?
CVE-2026-59714 is a high-severity missing authorization vulnerability in open-webui, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This issue is fixed in version 0.10.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-59714?
3 open source packages ship an affected version, including open-webui.
| Package | Affected | Fixed in |
|---|---|---|
open-webui PyPI | From 0.9.5 | 0.10.0 |
open-webui PyPI | From 0.9.5 | 0.10.0 |
open-webui PyPI | From 0.9.5 | 0.10.0 |
How do I fix CVE-2026-59714?
Upgrade open-webui to 0.10.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-59714 being exploited?
There is no known exploitation of CVE-2026-59714 in the wild and no public exploit code.
Sources
Also known as GHSA-x2ff-v5v8-m75m, PYSEC-2026-3605.