CVE-2026-87994

Executive Summary

CVE-2026-87994 is an authorization flaw (CWE-639, Authorization Bypass Through User-Controlled Key) in Open WebUI, a self-hosted AI chat platform. In versions 0.9.5 through 0.11.0, the channel branch of the chat_completion function in backend/open_webui/main.py verified channel write access and channel membership for a supplied message_id but failed to verify that the calling user was the original author of that message. This allows a channel member to overwrite another member's message content through the chat completions endpoint while the victim remains recorded as the stored author, silently corrupting the conversation record. Impact is limited to integrity of a single channel's conversation data (CVSS 4.3, I:L), with no confidentiality or availability impact and no cross-channel access.

Technical Analysis

The vulnerability resides in the message-submission path of the Open WebUI channel feature. According to the NVD description, the channel branch of chat_completion in backend/open_webui/main.py performed two authorization checks on a client-supplied message_id:

1. Channel write access — whether the calling user is permitted to write to the channel.
2. Channel membership — whether the calling user belongs to the channel.

Both checks are necessary for channel-scoped authorization, but neither establishes ownership of the targeted message. The missing check is an object-level ownership verification: confirming that the user identified by the request is the same principal that authored the message referenced by message_id. This is a classic instance of CWE-639, where the application trusts a user-controlled key (message_id) to select a record for modification without binding that record to the requester.

Because the authorization model conflated "is a member with write access" with "owns this message," any channel member could direct the completion endpoint at another member's message_id and replace its content. Two properties of the flaw are notable from a security-engineering standpoint:

• Author attribution is preserved. The stored author of the record remains the victim. From the perspective of downstream readers, the channel history shows the victim as the source of text they never wrote. This is a stored-data-manipulation primitive (T1565.001), not an account takeover.
• Scope is constrained. The description explicitly states the attacker gains no access to other channels. The flaw does not cross channel boundaries; it is an intra-channel integrity violation.

The attack surface is the authenticated chat completions endpoint, reachable over the network (AV:N). No user interaction is required (UI:N); the attacker acts alone. Exploitation requires only a low-privileged authenticated account (PR:L). Because the only demonstrable impact is unauthorized modification of an existing message within a channel the attacker can already access, the CVSS impact is limited to integrity (I:L), yielding 4.3. There is no injection-to-RCE, no privilege escalation, and no data exfiltration path described. Patch-confidence scoring across all tracked sources is 0/4, and the fix is identified only by version (0.11.1); no public PoC, Nuclei template, or exploit code is available, so the technical narrative above is derived solely from the vendor description rather than from observed exploitation.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-639) and the NVD description.

1. Reconnaissance / target identification. The attacker obtains a valid low-privileged account on an Open WebUI instance (versions 0.9.5–0.11.0) and is granted membership in a target channel, either by invitation or by self-joining where the instance allows it. The attacker interacts with the chat completions functionality to enumerate message identifiers visible in the channel, identifying a message_id authored by another member whose message they wish to alter.

2. Triggering the flaw. The attacker issues a request to the chat completions endpoint, supplying the victim's message_id as the target of the operation. The server-side logic in chat_completion validates that the caller has channel write access and is a channel member, but — this is the defect — does not validate that the caller authored the message identified by message_id. Both existing checks pass because the attacker is a legitimate channel member; the missing ownership check is the authorization gap.

3. Payload / execution method. At the vulnerability-class level, this is an object-key substitution: the attacker substitutes a message_id they do not own into a request that is otherwise authorized. The "payload" is the replacement message content supplied through the completions interface. No memory corruption, injection string, or special encoding is involved — the corruption is the unauthorized overwrite of a stored record. The description notes the victim is preserved as the stored author, so the modified content is attributed to the victim.

4. Post-exploitation impact. The attacker alters the conversation record of a channel they legitimately belong to, without gaining access to any channel they are not a member of. The practical consequences are data-integrity and trust effects: the conversation history can no longer be treated as authentic, a victim can be made to appear to have said something they never wrote, and any downstream workflow that consumes channel messages (audit, retrieval-augmented generation, compliance logging) ingests tampered data. There is no privilege escalation, no credential theft, and no cross-tenant breakout described.

Impact Assessment

Business impact is moderate and narrow. The vulnerability degrades the integrity of conversation records within an already-authorized channel: any member can rewrite another member's message while leaving the victim recorded as author. For organizations using Open WebUI as a shared AI collaboration platform, this undermines the trustworthiness of the message history for audit, review, and AI-context purposes. It is not a confidentiality breach (C:N) and does not affect availability (A:N); the CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, scoring 4.3 — Low. Exploitability is straightforward for an authenticated insider: low attack complexity, no user interaction, and no special conditions beyond channel membership. The blast radius is limited to channels where the attacker is already a member; the description explicitly excludes access to other channels, so there is no multi-tenant exposure. The absence of CISA KEV listing, public exploit code, and an EPSS score (not yet scored by FIRST.org) indicates no evidence of active exploitation in the wild. Primary risk is to insider-threat and data-provenance scenarios rather than external mass exploitation.

Detection Guidance

No IOCs or exploit artifacts exist publicly; the rules below target the behavioral pattern of an anomalous message rewrite and the authorization pattern of the vulnerable endpoint. Tune thresholds and field names (e.g., message_id, channel identifiers) to the deployment's actual schema before production use.

Sigma Rule

title: Open WebUI Channel Message Overwrite by Non-Author (CVE-2026-87994)
id: 8f3c2a1e-6b7d-4e9a-9c2f-0d1e2f3a4b5c
status: experimental
description: Detects chat completion requests targeting a channel message_id whose stored author differs from the authenticated caller, indicating exploitation of CVE-2026-87994.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87994
author: valtersit.com
date: 2026-01-01
logsource:
  product: open_webui
  service: application
detection:
  selection_endpoint:
    http_url|contains: '/api/chat/completions'
  selection_channel:
    request_body|contains: 'message_id'
  selection_mismatch:
    caller_user_id: '*'
  filter_author:
    message_author_id: '%caller_user_id%'
  condition: selection_endpoint and selection_channel and selection_mismatch and not filter_author
falsepositives:
  - Legitimate edits performed by the message author
  - Administrative moderation tooling that rewrites messages
level: medium
tags:
  - attack.t1565.001
  - cve.2026-87994

YARA Rule

rule CVE_2026_87994_OpenWebUI_Channel_Authz
{
    meta:
        description = "Flags Open WebUI chat_completion channel logic lacking author verification for message_id (CVE-2026-87994)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87994"
        date = "2026-01-01"
    strings:
        $s1 = "chat_completion" ascii
        $s2 = "message_id" ascii
        $s3 = "channel" ascii nocase
    condition:
        filesize < 5MB and all of ($s*) 
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87994 Open WebUI channel message overwrite attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/chat/completions"; http.request_body; content:"message_id"; nocase; threshold: type both, track by_src, count 20, seconds 60; reference:cve,2026-87994; classtype:attempted-user; sid:202687994; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [http where url.path == "/api/chat/completions" and http.request.method == "POST"]
  [http where url.path == "/api/chat/completions"
    and http.request.method == "POST"
    and http.request.body.text contains "message_id"]

Splunk SPL Query

index=web sourcetype=open_webui:access OR sourcetype=open_webui:app
| search uri_path="/api/chat/completions" method="POST"
| rex field=request_body "message_id\"?\s*[:=]\s*\"?(?<message_id>[A-Za-z0-9\-]+)"
| stats count min(_time) as first_seen max(_time) as last_seen values(caller_user_id) as callers by message_id, channel_id, message_author_id
| where isnotnull(message_id) AND isnotnull(message_author_id)
| where NOT match(callers, message_author_id)
| table first_seen last_seen channel_id message_id message_author_id callers count

Wazuh OSSEC Rule

<group name="open_webui,cve_2026_87994,">
  <rule id="2026879" level="7">
    <decoded_as>json</decoded_as>
    <field name="url">/api/chat/completions</field>
    <field name="method">POST</field>
    <match>message_id</match>
    <description>CVE-2026-87994: Open WebUI chat completion targeting a message_id - possible channel message overwrite</description>
    <mitre>
      <id>T1565.001</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
  <rule id="2026880" level="10">
    <if_sid>2026879</if_sid>
    <field name="message_author_id">\.</field>
    <description>CVE-2026-87994: message overwrite where caller differs from stored author - likely exploitation</description>
    <group>web_attack,integrity,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence from any tracked source — although the vendor description states the issue is fixed in version 0.11.1. Treat the following as guidance and verify the fix against the official release before relying on it.

1. Immediate mitigations (no upgrade possible yet).

   • Restrict channel membership to trusted principals and disable self-join where not required, reducing the pool of accounts that can trigger the intra-channel overwrite.
   • If feasible via a proxy or application policy, restrict or rate-limit access to the chat completions endpoint for non-owner message_id submissions; block requests where the authenticated caller does not match the stored message author.
   • Enable comprehensive logging on the channel and completions paths and alert on the anomaly patterns in the Detection Guidance section, since the tamper is otherwise silent.
   • Reduce the trust placed in raw Open WebUI channel history for audit or AI-context consumption until the platform is patched.

2. Patch / upgrade steps.

   • Upgrade Open WebUI to 0.11.1 or later per the vendor description. This is the version identified in the NVD record as containing the fix.
   • Verify the fix at the behavior level: submit a completions request targeting a message_id authored by another user and confirm the request is rejected.
   • Because Patch Confidence is 0/4, cross-check the authoritative Open WebUI release notes and NVD entry to confirm the exact fixed version before treating the upgrade as complete.

3. Long-term hardening.

   • Enforce object-level authorization as a standard pattern: any endpoint accepting a user-controlled object key (message_id, document_id, file_id) must verify ownership against the authenticated principal, not merely access rights to the container.
   • Add automated authorization regression tests covering cross-user object modification.
   • Adopt integrity controls over AI conversation records — hash-chained or signed message stores — so silent rewrites are detectable.
   • Monitor the Open WebUI advisory stream and NVD for the official patch reference to update Patch Confidence and adjust response.

References

• NVD — CVE-2026-87994: https://nvd.nist.gov/vuln/detail/CVE-2026-87994
• Open WebUI project: https://github.com/open-webui/open-webui
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1565.001 — Stored Data Manipulation: https://attack.mitre.org/techniques/T1565/001/
• FIRST EPSS — not yet scored for CVE-2026-87994 (no EPSS value available at time of writing)

No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence exists for CVE-2026-87994 per provided data. The CVE is not listed in CISA KEV. No threat actor campaigns are associated with this vulnerability as of this report.