CVE-2026-59215: Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/{id}/messages/{message_id}/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without verifying the parent belongs to that channel. By requesting a thread in a channel they can access while supplying a victim channel’s message id as the thread root, the attacker receives the victim message — content, channel id, and author.