CVE-2026-59215: Open WebUI Thread Information Disclosure Vulnerability

Technical summary

CVE-2026-59215 is an improper access control vulnerability (CWE-639) in Open WebUI's channel thread handling. When processing parent and reply relationships in threaded messages, the application fails to bind the parent_id parameter to the originating channel in its URL routing or validation logic. An authenticated attacker can craft requests referencing a parent_id from a private or direct message channel, causing the system to return thread context that should be isolated to that channel. The vulnerability requires valid authentication and relies on the attacker knowing or guessing valid message IDs from restricted channels.

Business impact

For organizations using Open WebUI as their self-hosted AI platform, this vulnerability creates information leakage risk among users with different channel access levels. Sensitive conversations, proprietary discussions, or confidential information shared in private channels or direct messages could be exposed to other authenticated users who should not have visibility. The impact scales with how broadly the system is deployed and how strictly channel permissions are enforced in the organization's workflow.

Affected systems

Open WebUI prior to version 0.10.0 is affected. The vulnerability requires an authenticated user account to trigger. Any deployment of Open WebUI with multi-channel or private conversation support using versions before 0.10.0 should be treated as at-risk, particularly if the instance hosts sensitive communications.

Exploitability

Exploitation requires valid authentication credentials and knowledge or enumeration of message IDs from target channels. The CVSS vector reflects high complexity (AC:H) because the attacker must identify valid parent_id values from restricted channels, a non-trivial reconnaissance step. However, once a valid ID is known, the attack itself is straightforward. There is no public evidence this has been weaponized in the wild, and the vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Open WebUI to version 0.10.0 or later. This release implements proper binding of parent_id parameters to the channel context, preventing cross-channel thread disclosure. No workarounds are available for earlier versions; patching is the only mitigation.

Patch guidance

Apply the upgrade to Open WebUI 0.10.0 immediately to all instances. Verify the upgrade by checking the application version in settings or via API endpoint responses. Coordinate the update during a maintenance window if the instance is actively used, as no inline configuration changes can mitigate this issue beforehand. Consult the Open WebUI release notes for any schema or configuration changes in 0.10.0.

Detection guidance

Monitor API and application logs for unusual thread or parent message queries, particularly those referencing parent_id values from channels the requesting user does not have explicit membership in. Look for HTTP requests to thread endpoints that include parent_id parameters inconsistent with the requested channel path. Review audit logs for any data exports or message reads from private channels by users who lack channel membership. Implement logging of all channel.thread or similar API calls with context on which channel the user accessed.

Why prioritize this

Although assigned a low CVSS score (3.1), this vulnerability directly impacts information confidentiality and should not be deprioritized indefinitely. The fix is simple and reliable—a single-version upgrade—making it an efficient remediation target. Prioritize patching based on whether your Open WebUI deployment contains sensitive multi-user or multi-channel conversations; if channel separation is critical to your data governance model, elevate priority accordingly.

Risk score, explained

CVSS 3.1 reflects the low attack complexity, authentication requirement, and information-only impact (no integrity or availability damage). The 'high complexity' rating acknowledges that successful exploitation requires identifying valid message IDs from off-limits channels, which is not trivial without prior reconnaissance. The single low-severity outcome (limited confidentiality impact) justifies the 3.1 score, though in organizational contexts the business impact may exceed the technical rating.

Frequently asked questions