medium

CVE-2026-59222

PyPI · open-webui

Summary

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Severity
medium
EPSS
0.5% (p40)
CWE
CWE-200
Also known as
GHSA-gh7p-78x6-jw6m
Published
2026-07-24
Updated
2026-07-24

Advisory details

Summary

The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (settings.ui.toolServers[].key), which is not available via standard user info APIs.

Details

The endpoint GET /api/v1/channels/{id}/members returns the full serialized user model for every member in the channel. In both the DM and non-DM code paths, the handler constructs the response with [UserModelResponse(**user.model_dump(), is_active=...)] and returns it as the users list. Because UserModel (models/users.py) includes a settings object (UserSettings) and arbitrary UI configuration (settings.ui), the endpoint exposes other users' sensitive configuration to any channel participant.

Practically, a regular user who participates in a DM or group can call /api/v1/channels/{id}/members and receive other members' settings, including admin-only details such as webhook notification URLs and tool server configuration, including credential fields like settings.ui.toolServers[].key. These values are not returned by the normal user profile endpoints (e.g., /api/v1/users/{user_id}/info).

PoC

  1. Start a local Open WebUI instance
  2. Log in as admin and in the Admin Panel, go to Settings -> General and check Channels (Beta), then press Save.
  3. Create a low-privilege user in the Users tab
  4. Click on the admin's profile bottom left, Settings and Integrations. Then click the + after Manage Tool Servers to add some tool server with a secret Bearer token (eg. KEY)
  5. Log in as the attacker with the low-privilege account and create a new Direct Message channel with the admin user:
image
  1. After creating, open DevTools with F12 and go to the Network tab. Then in the DM UI click on the Users icon top right to see the members. In the network tab, this should have triggered a /api/v1/channels/{id}/members request which responds with the settings key including toolServers and key values:
image

The attacker has now leaked the admin's bearer token for the toolserver they configured.

Impact

Conditions for exploit: channels are enabled and an attacker has a low-privilege account.

Webhook URLs and tool server configurations (including bearer keys) can be exfiltrated from any user.

Original Agent Report

app aikido dev_ai-pentests_projects_116389_assessments_019d67d4-81c8-7dd2-bb9e-0a4a774b2c78_issues_sidebarIssue=20440423 (4)

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.