CVE-2026-59215
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In Open WebUI prior to version 0.10.0, a vulnerability exists where channel thread parent and reply handling did not bind parent_id to the channel in the URL. This allows an authenticated user to reference a message from another private or DM channel and disclose thread context across channels.
Risk Assessment
The risk involves unauthorized access to private conversation content and threads, potentially leading to leakage of confidential information between users or channels.
Recommendation
Immediately update Open WebUI to version 0.10.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread parent and reply handling did not bind parent_id to the channel in the URL, allowing an authenticated user to reference a message from another private or DM channel and disclose thread context across channels. This issue is fixed in version 0.10.0.