{"id":"CVE-2026-59215","aliases":["GHSA-73x5-h92w-xc2j","PYSEC-2026-3591"],"url":"https://o3.security/vulnerability/CVE-2026-59215","summary":"Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding","details":"## Summary\n\nA normal authenticated user can read the content of a message in a private channel they do not belong to. `GET /api/v1/channels/{id}/messages/{message_id}/thread` authorizes the caller against the URL channel, but the underlying thread lookup loads the thread *parent* by id and returns it without verifying the parent belongs to that channel. By requesting a thread in a channel they can access while supplying a victim channel's message id as the thread root, the attacker receives the victim message — content, channel id, and author.\n\n## Affected component\n\n- `backend/open_webui/models/messages.py` — `get_messages_by_parent_id()`\n- `backend/open_webui/routers/channels.py` — `get_channel_thread_messages()` (read), `new_message_handler()` (parent/reply binding on write)\n\n## Root cause\n\n`get_messages_by_parent_id(channel_id, parent_id)` filters the thread *replies* by `channel_id`, but loads the thread *parent* by id alone and appends it without requiring `parent.channel_id == channel_id`:\n\n```python\nmessage = await db.get(Message, parent_id)     # loaded by id only — no channel binding\nif not message:\n    return []\n# replies are filtered by channel_id ...\nif len(all_messages) < limit:\n    all_messages.append(message)               # parent appended unconditionally\n```\n\n`get_channel_thread_messages()` authorizes only the URL channel, then calls `get_messages_by_parent_id(id, message_id)` with the caller-supplied `message_id`. The reply insert path (`new_message_handler` → `insert_new_message`) also stored a caller-supplied `parent_id` without binding it to the channel.\n\n## Impact\n\nA non-member can disclose the content (plus channel id and author metadata) of a private-channel message whose id they know or obtain. Direct reads of the victim channel/message/thread return 403; the disclosure is via the thread parent of a channel the attacker can access. Read-only, one message per known id.\n\n## Proof of Concept\n\n(reporter) Validated on v0.9.6: `GET /channels/{attacker_channel}/messages/{victim_message_id}/thread` returned the victim's private message — content, victim channel id, and author — although direct reads of the victim channel returned 403.\n\n## Fix\n\nBind the thread parent to the requested channel: `get_messages_by_parent_id` returns `[]` unless the parent exists and `parent.channel_id == channel_id`. Defence-in-depth on the write path: `new_message_handler` rejects a supplied `parent_id`/`reply_to_id` whose message does not belong to the URL channel.\n\n## Affected / Patched\n\n- Affected: `< 0.10.0` (last affected release 0.9.6)\n- Patched: v0.10.0 (PR #25766). `get_messages_by_parent_id` binds the thread parent to the requested channel (returns `[]` unless `parent.channel_id == channel_id`), and `new_message_handler` rejects a caller-supplied `parent_id`/`reply_to_id` whose message does not belong to the channel.","published":"2026-07-09T16:57:24.325Z","modified":"2026-10-21T02:30:29.188562535Z","cvss":{"score":3.1,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.00323,"percentile":0.25267,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"open-webui","fixedVersion":"0.10.0"}],"fix":{"url":"https://github.com/open-webui/open-webui/commit/a66477b7104c5d141ce7bffaea424b43e7666ef1","label":"open-webui/open-webui@a66477b"},"references":[{"type":"WEB","url":"https://github.com/open-webui/open-webui/releases/tag/v0.10.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59215.json"},{"type":"ADVISORY","url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-73x5-h92w-xc2j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59215"},{"type":"FIX","url":"https://github.com/open-webui/open-webui/commit/a66477b7104c5d141ce7bffaea424b43e7666ef1"},{"type":"FIX","url":"https://github.com/open-webui/open-webui/pull/25766"},{"type":"PACKAGE","url":"https://github.com/open-webui/open-webui"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:29.188562535Z"}}