Information Disclosure in Open WebUI

Executive Summary

CVE-2026-59222 is a vulnerability in Open WebUI versions 0.7.0 to 0.9.0 where the API endpoint /api/v1/channels/{id}/members returns full user model data for channel members. This includes sensitive settings such as tool server keys and webhook configurations. Because of this, any normal channel participant can retrieve other users' sensitive settings, which should normally be restricted.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Open WebUI versions 0.7.0 to 0.9.0 allows unauthorized channel participants to access sensitive user settings, including admin-only configurations such as webhook URLs and tool server keys. This exposure of sensitive information to unauthorized actors can lead to violations of data protection principles found in common standards and regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data.

Because the vulnerability results in unauthorized disclosure of sensitive user data, it could compromise compliance with confidentiality and data protection requirements mandated by these regulations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a low-privilege user to access sensitive information of other users in a channel, including admin-only configurations like webhook URLs and tool server bearer tokens. This unauthorized data exposure can lead to compromise of system integrity, unauthorized access to services, and potential misuse of credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring requests to the endpoint /api/v1/channels/{id}/members on Open WebUI versions 0.7.0 to 0.9.0. Specifically, if a normal channel participant is able to retrieve full user model data including sensitive settings such as toolServers[].key and webhook configurations, the vulnerability is present.

To detect exploitation attempts, you can look for HTTP GET requests to the endpoint /api/v1/channels/{id}/members and inspect the response payload for sensitive fields like toolServers keys or webhook URLs.

Example command using curl to test the endpoint (replace {id} with a channel ID):

• curl -i -H "Authorization: Bearer <user_token>" https://<openwebui-host>/api/v1/channels/{id}/members

If the response contains sensitive user settings or webhook configurations, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Open WebUI to version 0.10.0 or later, where this vulnerability has been fixed.

Until the upgrade can be performed, restrict access to the /api/v1/channels/{id}/members endpoint to trusted users only, or implement network-level controls to limit exposure.

Additionally, review and rotate any potentially exposed credentials such as tool server bearer tokens or webhook URLs that may have been leaked.

Useful 0 Not Useful 0