CVE-2026-87994: Open WebUI channel authz gap

Q: Is CVE-2026-87994 actively exploited?

No confirmed active exploitation of CVE-2026-87994 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-87994?

Upgrade Open WebUI to version 0.11.1 or later, which adds the missing authorship check for the targeted message_id. Until patched, limit channel membership to trusted, vetted users and avoid using channel history as an unmodifiable audit record. For detection, review Open WebUI access/application logs for chat completion requests where the message_id parameter does not belong to the requesting user, and monitor for unexpected edits to messages attributed to other users. Treat any compliance or review process that relies on Open WebUI channel transcripts as needing independent corroboration until upgraded.

Q: What systems are affected by CVE-2026-87994?

This vulnerability affects the following AI/ML architecture patterns: model serving.

Q: What is the CVSS score for CVE-2026-87994?

CVE-2026-87994 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.22%.

CISO Take

Open WebUI's chat completions endpoint checks that a user has write access and membership in a channel, but never verifies that the user actually authored the message they're targeting — so any channel member can silently overwrite a teammate's stored message while the system keeps showing the original author's name. There's no public exploit, no Nuclei template, it isn't in CISA KEV, and EPSS data isn't available, so this isn't being mass-exploited today; the CVSS 4.3 (network, low complexity, low privileges, no user interaction) reflects a real but narrow integrity issue rather than a confidentiality or availability breach. The package carries a risk score of 38/100 and a history of 168 prior CVEs, and only 3 downstream dependents are tracked, so blast radius is limited but the platform's overall security track record is unremarkable. Because Open WebUI channels are often used for team or agent collaboration transcripts, a falsified message with an unchanged author byline can undermine trust in records used for review or compliance purposes. Action: upgrade to Open WebUI 0.11.1 or later; if immediate patching isn't possible, restrict channel membership to trusted users and treat channel message history as unverified until upgraded.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium-low risk overall. The flaw requires an authenticated, low-privileged channel member (PR:L) and no user interaction, making it easy to exploit for anyone already inside a channel, but it cannot be triggered by external unauthenticated attackers and grants no access to other channels or data outside the targeted message. Impact is confined to integrity (I:L) — no confidentiality or availability effect — so the worst case is a corrupted conversation record with misattributed authorship. No public PoC, scanner template, KEV listing, or EPSS score exists, indicating no evidence of active or imminent exploitation. The main residual concern is trust: in collaborative or compliance-relevant AI deployments, an unnoticed message rewrite could mislead reviewers or auditors relying on Open WebUI transcripts as a record of what was said.

How does the attack unfold?

Initial Access

Attacker holds or obtains a legitimate low-privilege account with membership in a shared Open WebUI channel.

AML.T0012

Exploitation

Attacker calls the chat completions endpoint with the message_id of another member's message; the server verifies channel membership and write access but not authorship, allowing the request to proceed.

AML.T0049

Impact

The targeted message's content is replaced while the original author's name remains attached, corrupting the conversation record and misleading anyone relying on it.

AML.T0092

Initial Access

Attacker holds or obtains a legitimate low-privilege account with membership in a shared Open WebUI channel.

AML.T0012

Exploitation

Attacker calls the chat completions endpoint with the message_id of another member's message; the server verifies channel membership and write access but not authorship, allowing the request to proceed.

AML.T0049

Impact

The targeted message's content is replaced while the original author's name remains attached, corrupting the conversation record and misleading anyone relying on it.

AML.T0092

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.9.5, < 0.11.1	`0.11.1`
151.8K 3 dependents Pushed 7d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

Upgrade Open WebUI to version 0.11.1 or later, which adds the missing authorship check for the targeted message_id. Until patched, limit channel membership to trusted, vetted users and avoid using channel history as an unmodifiable audit record. For detection, review Open WebUI access/application logs for chat completion requests where the message_id parameter does not belong to the requesting user, and monitor for unexpected edits to messages attributed to other users. Treat any compliance or review process that relies on Open WebUI channel transcripts as needing independent corroboration until upgraded.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Framework Inference AML.T0049 - Exploit Public-Facing Application AML.T0092 - Manipulate User LLM Chat History

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system data quality and record integrity

NIST AI RMF

GOVERN 1.5 / MAP 4.1 - Accountability and traceability of AI system interactions

Frequently Asked Questions

What is CVE-2026-87994?

Open WebUI's chat completions endpoint checks that a user has write access and membership in a channel, but never verifies that the user actually authored the message they're targeting — so any channel member can silently overwrite a teammate's stored message while the system keeps showing the original author's name. There's no public exploit, no Nuclei template, it isn't in CISA KEV, and EPSS data isn't available, so this isn't being mass-exploited today; the CVSS 4.3 (network, low complexity, low privileges, no user interaction) reflects a real but narrow integrity issue rather than a confidentiality or availability breach. The package carries a risk score of 38/100 and a history of 168 prior CVEs, and only 3 downstream dependents are tracked, so blast radius is limited but the platform's overall security track record is unremarkable. Because Open WebUI channels are often used for team or agent collaboration transcripts, a falsified message with an unchanged author byline can undermine trust in records used for review or compliance purposes. Action: upgrade to Open WebUI 0.11.1 or later; if immediate patching isn't possible, restrict channel membership to trusted users and treat channel message history as unverified until upgraded.

Is CVE-2026-87994 actively exploited?

No confirmed active exploitation of CVE-2026-87994 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87994?

Upgrade Open WebUI to version 0.11.1 or later, which adds the missing authorship check for the targeted message_id. Until patched, limit channel membership to trusted, vetted users and avoid using channel history as an unmodifiable audit record. For detection, review Open WebUI access/application logs for chat completion requests where the message_id parameter does not belong to the requesting user, and monitor for unexpected edits to messages attributed to other users. Treat any compliance or review process that relies on Open WebUI channel transcripts as needing independent corroboration until upgraded.

What systems are affected by CVE-2026-87994?

This vulnerability affects the following AI/ML architecture patterns: model serving.

What is the CVSS score for CVE-2026-87994?

CVE-2026-87994 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

model serving

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0092 Manipulate User LLM Chat History

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 1.5 / MAP 4.1

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id but did not verify that the calling user authored the targeted message. A channel member could use the chat completions endpoint to replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. This issue is fixed in version 0.11.1.

Exploitation Scenario

A disgruntled or compromised low-privilege member of a shared Open WebUI channel identifies the message_id of another member's post (visible via the UI or API responses) and issues a request to the chat completions endpoint referencing that message_id. Because the server only checks that the caller has write access and is a member of the channel — not that they authored the specific message — the request succeeds, replacing the victim's message content while the UI continues to display the victim as the author. The attacker could use this to insert false approvals, misleading instructions, or fabricated statements into a team's AI-assisted workflow, damaging trust in the conversation record without ever needing access to other channels or data.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-862 Missing Authorization Primary CWE-639 Authorization Bypass Through User-Controlled Key CWE-862 Missing Authorization

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.