Affected: open-webui

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the channel router does not call filter_allowed_access_grants on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin's permission framework. This vulnerability is fixed in 0.9.0.

Affected: PyPI: open-webui

# Channel Access Grants Bypass filter_allowed_access_grants

## Affected Component

Channel creation and update endpoints: - `backend/open_webui/routers/channels.py` (lines 291-340, `create_new_channel`) - `backend/open_webui/routers/channels.py` (lines 617-638, `update_channel_by_id`) - `backend/open_webui/models/channels.py` (lines 825-826, `set_access_grants` call without filtering)

## Affected Versions

Current main branch (commit `6fdd19bf1`) and likely all versions supporting user-created group channels with access grants.

## Description

All resource routers in Open WebUI (knowledge, models, notes, prompts, tools, skills) call `filter_allowed_access_grants()` before persisting access grants. This function strips `principal_id: "*"` wildcard grants from users who lack the relevant `sharing.public_*` permission, and strips individual user grants from users who lack `access_grants.allow_users` permission.

The channel router does not call `filter_allowed_access_grants` on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin's permission framework.

```python # channels.py — access_grants from form data flow directly into persistence # No call to filter_allowed_access_grants() anywhere in these paths.

# Compare with knowledge.py / models.py / notes.py / prompts.py / tools.py / skills.py, # all…