https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 11:44:54 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09665 bdu:2026-09665 https://cve.radiocsirt.org/vuln/bdu:2026-09665 https://cve.radiocsirt.org/vuln/euvd-2026-319392 EUVD-2026-319392 https://cve.radiocsirt.org/vuln/euvd-2026-319392 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44558 <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the channel router does not call filter_allowed_access_grants on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin&#39;s permission framework. This vulnerability is fixed in 0.9.0.</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the channel router does not call filter_allowed_access_grants on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin&#39;s permission framework. This vulnerability is fixed in 0.9.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44558 https://cve.radiocsirt.org/vuln/ghsa-7rjh-px4v-5w55 <p><strong>Affected:</strong> PyPI: open-webui</p> <p># Channel Access Grants Bypass filter_allowed_access_grants</p> <p>## Affected Component</p> <p>Channel creation and update endpoints: - `backend/open_webui/routers/channels.py` (lines 291-340, `create_new_channel`) - `backend/open_webui/routers/channels.py` (lines 617-638, `update_channel_by_id`) - `backend/open_webui/models/channels.py` (lines 825-826, `set_access_grants` call without filtering)</p> <p>## Affected Versions</p> <p>Current main branch (commit `6fdd19bf1`) and likely all versions supporting user-created group channels with access grants.</p> <p>## Description</p> <p>All resource routers in Open WebUI (knowledge, models, notes, prompts, tools, skills) call `filter_allowed_access_grants()` before persisting access grants. This function strips `principal_id: &#34;*&#34;` wildcard grants from users who lack the relevant `sharing.public_*` permission, and strips individual user grants from users who lack `access_grants.allow_users` permission.</p> <p>The channel router does not call `filter_allowed_access_grants` on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin&#39;s permission framework.</p> <p>```python # channels.py — access_grants from form data flow directly into persistence # No call to filter_allowed_access_grants() anywhere in these paths.</p> <p># Compare with knowledge.py / models.py / notes.py / prompts.py / tools.py / skills.py, # all…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p># Channel Access Grants Bypass filter_allowed_access_grants</p> <p>## Affected Component</p> <p>Channel creation and update endpoints: - `backend/open_webui/routers/channels.py` (lines 291-340, `create_new_channel`) - `backend/open_webui/routers/channels.py` (lines 617-638, `update_channel_by_id`) - `backend/open_webui/models/channels.py` (lines 825-826, `set_access_grants` call without filtering)</p> <p>## Affected Versions</p> <p>Current main branch (commit `6fdd19bf1`) and likely all versions supporting user-created group channels with access grants.</p> <p>## Description</p> <p>All resource routers in Open WebUI (knowledge, models, notes, prompts, tools, skills) call `filter_allowed_access_grants()` before persisting access grants. This function strips `principal_id: &#34;*&#34;` wildcard grants from users who lack the relevant `sharing.public_*` permission, and strips individual user grants from users who lack `access_grants.allow_users` permission.</p> <p>The channel router does not call `filter_allowed_access_grants` on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin&#39;s permission framework.</p> <p>```python # channels.py — access_grants from form data flow directly into persistence # No call to filter_allowed_access_grants() anywhere in these paths.</p> <p># Compare with knowledge.py / models.py / notes.py / prompts.py / tools.py / skills.py, # all…</p> https://cve.radiocsirt.org/vuln/ghsa-7rjh-px4v-5w55 https://cve.radiocsirt.org/vuln/pysec-2026-2711 <p><strong>Affected:</strong> PyPI: open-webui</p> <p># Channel Access Grants Bypass filter_allowed_access_grants</p> <p>## Affected Component</p> <p>Channel creation and update endpoints: - `backend/open_webui/routers/channels.py` (lines 291-340, `create_new_channel`) - `backend/open_webui/routers/channels.py` (lines 617-638, `update_channel_by_id`) - `backend/open_webui/models/channels.py` (lines 825-826, `set_access_grants` call without filtering)</p> <p>## Affected Versions</p> <p>Current main branch (commit `6fdd19bf1`) and likely all versions supporting user-created group channels with access grants.</p> <p>## Description</p> <p>All resource routers in Open WebUI (knowledge, models, notes, prompts, tools, skills) call `filter_allowed_access_grants()` before persisting access grants. This function strips `principal_id: &#34;*&#34;` wildcard grants from users who lack the relevant `sharing.public_*` permission, and strips individual user grants from users who lack `access_grants.allow_users` permission.</p> <p>The channel router does not call `filter_allowed_access_grants` on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin&#39;s permission framework.</p> <p>```python # channels.py — access_grants from form data flow directly into persistence # No call to filter_allowed_access_grants() anywhere in these paths.</p> <p># Compare with knowledge.py / models.py / notes.py / prompts.py / tools.py / skills.py, # all…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p># Channel Access Grants Bypass filter_allowed_access_grants</p> <p>## Affected Component</p> <p>Channel creation and update endpoints: - `backend/open_webui/routers/channels.py` (lines 291-340, `create_new_channel`) - `backend/open_webui/routers/channels.py` (lines 617-638, `update_channel_by_id`) - `backend/open_webui/models/channels.py` (lines 825-826, `set_access_grants` call without filtering)</p> <p>## Affected Versions</p> <p>Current main branch (commit `6fdd19bf1`) and likely all versions supporting user-created group channels with access grants.</p> <p>## Description</p> <p>All resource routers in Open WebUI (knowledge, models, notes, prompts, tools, skills) call `filter_allowed_access_grants()` before persisting access grants. This function strips `principal_id: &#34;*&#34;` wildcard grants from users who lack the relevant `sharing.public_*` permission, and strips individual user grants from users who lack `access_grants.allow_users` permission.</p> <p>The channel router does not call `filter_allowed_access_grants` on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin&#39;s permission framework.</p> <p>```python # channels.py — access_grants from form data flow directly into persistence # No call to filter_allowed_access_grants() anywhere in these paths.</p> <p># Compare with knowledge.py / models.py / notes.py / prompts.py / tools.py / skills.py, # all…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2711