CVE-2026-59222: Sensitive Data Exposure in Open WebUI Channels API

Open WebUI is an extensible, self-hosted AI platform designed to provide a user-friendly interface for interacting with large language models. The platform features user authentication, workspace/channel management, and integration with external API services and tool servers.

The vulnerability classified under CVE-2026-59222 represents a case of excessive data exposure during API serialization. Specifically, the API endpoint responsible for listing members of a communication channel (GET /api/v1/channels/{id}/members) inadvertently leaks the full configuration schema of each user.

This vulnerability allows authenticated users to retrieve sensitive details of any other user sharing a channel. Exposed details include private configurations and access keys for external services, potentially leading to unauthorized access to downstream resources.

The root cause of this flaw is the over-serialization of the user database model in the backend API router. The platform uses FastAPI and Pydantic for API route definition and data validation.

In affected versions, the route handler get_channel_members_by_id returned a UserListResponse. This response schema mapped user objects to the generic UserModelResponse profile, which compiled all user data directly from the raw database model.

The raw database model contains a settings block containing integration secrets, such as external tool server bearer tokens (toolServers[].key) and private webhook URLs. Because the schema lacked explicit field filtering for sub-resources, the application serialized and transmitted this sensitive data to the client.

The vulnerability exists in the backend/open_webui/routers/channels.py file. The original endpoint serialized database entities using a wholesale dictionary dump.

# Vulnerable Serialization Path
return {
    'users': [UserModelResponse(**u.model_dump(), is_active=Users.is_active(u)) for u in fetched_users],
    'total': total,
}

The call to u.model_dump() converts the entire database record, including the nested settings dictionary, into the response object. The target UserModelResponse Pydantic schema did not exclude these nested elements, meaning they were exposed in the final JSON output.

The fix introduced a dedicated schema called ChannelMemberResponse that explicitly declares which fields are allowed in the API response. The patch replaces the blanket model_dump() with a strict manual mapper.

class ChannelMemberResponse(BaseModel):
    id: str
    email: str
    name: str
    role: str
    profile_image_url: str | None = None
    presence_state: str | None = None
    status_emoji: str | None = None
    status_message: str | None = None
    status_expires_at: int | None = None
    is_active: bool = False
 
def serialize_channel_member(user: UserModel) -> ChannelMemberResponse:
    return ChannelMemberResponse(
        id=user.id,
        email=user.email,
        name=user.name,
        role=user.role,
        profile_image_url=user.profile_image_url,
        presence_state=user.presence_state,
        status_emoji=user.status_emoji,
        status_message=user.status_message,
        status_expires_at=user.status_expires_at,
        is_active=Users.is_active(user),
    )

By passing each user record through serialize_channel_member, only the specified fields are retained. The backend drops any unmapped fields, such as settings or credentials, before serialization.

To exploit this vulnerability, an attacker must have a valid user account on the target Open WebUI instance. The attacker must also share at least one channel with the targeted users, such as an instance administrator.

An attacker first obtains the unique identifier of the shared channel. This can be extracted from the browser's address bar or via active network inspection of the client-side API requests.

The attacker then executes a direct HTTP GET request to the /api/v1/channels/{id}/members endpoint. The attacker includes their valid session JSON Web Token (JWT) in the Authorization header.

GET /api/v1/channels/d3b07384-d113-4ec5-a5af-72013840ffcc/members HTTP/1.1
Host: openwebui.local
Authorization: Bearer <attacker_jwt>

The server responds with a JSON array containing the user objects. The attacker parses the JSON body to locate the settings path, extracting the credentials for integrated tools or external servers.

The primary impact of this vulnerability is the compromise of confidential integration credentials. Exposed keys can allow attackers to access external private APIs and tools managed by the victim.

If an administrator is a member of the channel, their credentials and system webhooks are exposed. Attackers can leverage these webhooks to send forged messages or retrieve private operational data.

The vulnerability has been assigned a CVSS score of 6.5 (Medium) under CVSS v3.1, reflecting high confidentiality impact with low privileges required. No integrity or availability impact is directly associated with this vector.

Administrators must upgrade Open WebUI instances to version 0.10.0 or later to resolve this vulnerability. The updated versions implement strict data-transfer-object mapping that prevents data leakage.

For systems where an immediate upgrade is not feasible, administrators should audit active channel memberships. Restricting channel access and removing inactive users can limit the exposure surface.

Developers must implement strict, white-list-based schemas for all public endpoints. Avoiding generic database-model serialization prevents accidental exposure of backend fields.