CVE-2026-44559: Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

May 8, 2026 (updated May 15, 2026)

The GET /api/v1/channels/{id}/members endpoint only checks membership for group and dm channel types (lines 467-469). For standard channels — including private ones — there is no channel_has_access check before returning the member list. Any authenticated user who knows a private channel’s UUID can enumerate all users with access to that channel.

References

github.com/advisories/GHSA-c7wp-3qh5-55pv
github.com/open-webui/open-webui/security/advisories/GHSA-c7wp-3qh5-55pv
nvd.nist.gov/vuln/detail/CVE-2026-44559

Code Behaviors & Features

Detect and mitigate CVE-2026-44559 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →