CVE-2026-44561 — Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the is_user_channel_member function checks whether a ChannelMe…
Published: 2026-05-15 · CVSS: 5.4 · CVSS 3.1
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the is_user_channel_member function checks whether a ChannelMember row exists but does not check the is_active field. When a user is deactivated from a group or DM channel (removed by the channel owner, or leaves voluntarily), their membership row persists with is_active=False and status='left'. Because the authorization check ignores this field, the deactivated user retains full read and write access to the channel via direct API calls. This vulnerability is fixed in 0.9.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7