CVE-2026-59215

Published: Jul 9, 2026Modified: Jul 13, 2026

3.1

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.6 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread parent and reply handling did not bind parent_id to the channel in the URL, allowing an authenticated user to reference a message from another private or DM channel and disclose thread context across channels. This issue is fixed in version 0.10.0.

Affected (1)

Products: Openwebui: Open Webui

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openwebui Open Webui	Before 0.10.0

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (5)

https://github.com/open-webui/open-webui/commit/a66477b7104c5d141ce7bffaea424b43e7666ef1

Source: security-advisories@github.com

Patch

https://github.com/open-webui/open-webui/pull/25766

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/open-webui/open-webui/releases/tag/v0.10.0

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/open-webui/open-webui/security/advisories/GHSA-73x5-h92w-xc2j

Source: security-advisories@github.com

MitigationVendor Advisory

https://github.com/open-webui/open-webui/security/advisories/GHSA-73x5-h92w-xc2j

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

MitigationVendor Advisory

Timeline

No history available yet.