{"id":"GHSA-3vvh-g22g-jq6r","kind":"vulnerability","aliases":["GHSA-3vvh-g22g-jq6r"],"related":[],"title":"Channel members can post messages shown as a webhook via client-supplied message metadata","description":"# Channel members can post messages shown as a webhook via client-supplied message metadata\r\n\r\n## Summary\r\nAny member who can post in a channel can make their message appear as if a real webhook of that channel posted it. The server stored the metadata the client sent with a message without checking it. The channel then showed the message under the webhook's name and role, with no webhook token required.\r\n\r\n## Preconditions\r\nChannels are enabled (`ENABLE_CHANNELS`, default `False`). The channel has at least one webhook. The attacker is a member with write access to the channel. The attacker knows the webhook's id. Any member can read it from a message the webhook posted, so it is not a secret. Instances with channels disabled, or without channel webhooks, are not affected.\r\n\r\n## Impact\r\nA member can post, edit and pin messages that other members see as coming from a trusted webhook, such as an alerting or ops bot. That makes social engineering inside the channel easy. The stored author is still the attacker's account. The attacker cannot change the webhook's real messages, read anything new or act with the webhook's token.\r\n\r\n## Fix\r\nFixed in #32421. The server now drops any message metadata sent by the client, both when a message is posted and when it is edited, so only the server sets it. Upgrading is enough.\r\n\r\n## Root cause\r\nComponent: the channel message post and edit endpoints in `backend/open_webui/routers/channels.py`. Affected setup: every build with channel webhooks, from 0.7.0. The message form accepted an arbitrary metadata object from the client and stored it as is. The message list and the pinned list then trusted that metadata to decide who the message was from. A webhook id in the metadata was enough for the message to be shown as that webhook.\r\n\r\n## Proof of concept\r\n1. Admin creates a webhook \"Ops Bot\" in a channel, and the webhook posts a message.\r\n2. Alice, a channel member, reads the webhook id from that message.\r\n3. Alice posts a message with `meta.webhook = {\"id\": \"<webhook id>\", \"name\": \"Ops Bot\"}` and pins it.\r\n4. Bob opens the channel. The message and the pinned list show it as `Ops Bot` with role `webhook`, while the stored author is Alice.\r\n\r\nRun by the reporter on 0.11.3.\r\n\r\n## Credits\r\n@Tarekinh0 (reporter)","summary":"Open WebUI stored client-supplied message metadata without checking it, so a channel member can post a message that displays under a channel webhook's name and role. An attacker can use this to deceive other channel members, such as those who trust an alerting or ops bot, but cannot read new data or use the webhook's token.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"open-webui","fixed":["0.12.2"],"affected":">= 0.7.0, < 0.12.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","channels","cwe-290","cwe-345","cwe-863","open-webui","python","self-hosted","webhooks"],"not_affected_if":["channels-disabled","no-channel-webhooks","version-0.12.2-or-later"],"how_to_check":"- Check whether `ENABLE_CHANNELS` is set to `true` on the instance.\n- Check whether any channel has at least one webhook configured.\n- Check the installed Open WebUI version, for example with `pip show open-webui`; versions from `0.7.0` up to but not including `0.12.2` are affected.","fix":"- `open-webui` `0.12.2` (fixed in #32421; the server now drops client-sent message metadata on post and edit, and upgrading is enough).","status":"open","published_at":"2026-10-18T19:50:50+00:00","first_seen_at":"2026-11-09T22:53:28+00:00","triaged_at":"2026-11-09T22:57:12+00:00","updated_at":"2026-11-09T22:57:12+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-09T22:57:12Z","model":"claude-haiku-5-5","output":{"fix":"- `open-webui` `0.12.2` (fixed in #32421; the server now drops client-sent message metadata on post and edit, and upgrading is enough).","reach":"network","title":"Open WebUI: channel members can forge messages as trusted webhook posts","impact":"low","summary":"Open WebUI stored client-supplied message metadata without checking it, so a channel member can post a message that displays under a channel webhook's name and role. An attacker can use this to deceive other channel members, such as those who trust an alerting or ops bot, but cannot read new data or use the webhook's token.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["open-webui","self-hosted","python","channels","webhooks"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"A channel member impersonates a trusted webhook bot inside the channel","analyst_note":"","how_to_check":"- Check whether `ENABLE_CHANNELS` is set to `true` on the instance.\n- Check whether any channel has at least one webhook configured.\n- Check the installed Open WebUI version, for example with `pip show open-webui`; versions from `0.7.0` up to but not including `0.12.2` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["channels-disabled","no-channel-webhooks","version-0.12.2-or-later"],"who_is_affected":"Only Open WebUI instances with channels enabled (`ENABLE_CHANNELS` is `false` by default) and at least one channel webhook are exposed. The attacker must be a channel member with write access who knows the webhook id, which any member can read from a message the webhook posted. Instances with channels disabled or without channel webhooks are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000849,"input_tokens":5285,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-290':34B '-345':36B '-863':38B '0.11.3':483C '0.7.0':356C '1':411C '2':427C '3':439C '32421':304C '3vvh':18A,23A '4':453C 'accept':360C 'access':200C 'account':281C 'act':295C 'admin':412C 'affect':238C,348C 'ai':30B 'ai-tool':29B 'alert':92B,261C 'alic':428C,440C,477C 'anyth':292C 'appear':135C 'arbitrari':362C 'attack':77B,194C,205C,279C,283C 'author':275C,475C 'backend/open_webui/routers/channels.py':347C 'bob':454C 'bot':95B,264C,417C,449C,468C 'build':351C 'cannot':97B,284C 'caus':337C 'chang':285C 'channel':1A,32B,60B,70B,84B,107C,130C,143C,161C,179C,183C,187C,203C,230C,234C,271C,340C,353C,420C,430C,457C 'check':56B,158C 'client':12A,51B,118C,152C,315C,367C 'client-suppli':11A,50B,117C 'come':253C 'compon':338C 'concept':410C 'creat':413C 'credit':484C 'cwe':33B,35B,37B 'data':100B 'deceiv':82B 'decid':385C 'default':184C 'disabl':231C 'display':67B 'drop':308C 'easi':272C 'edit':244C,326C,344C 'enabl':181C,182C 'endpoint':345C 'engin':268C 'enough':335C,398C 'everi':350C 'fals':185C 'fix':301C,302C 'form':359C 'g22g':19A,24A 'ghsa':17A,22A 'ghsa-3vvh-g22g-jq6r':16A,21A 'host':45B 'id':210C,393C,435C,446C 'impact':239C 'insid':269C 'instanc':228C 'jq6r':20A,25A 'know':206C 'least':190C 'list':375C,379C,463C 'make':132C,266C 'member':2A,61B,85B,108C,124C,197C,212C,241C,250C,431C 'messag':5A,14A,53B,65B,111C,120C,134C,156C,165C,218C,247C,290C,310C,319C,341C,358C,374C,388C,401C,426C,438C,443C,459C 'meta.webhook':445C 'metadata':15A,54B,121C,150C,311C,363C,383C,396C 'name':73B,170C,447C 'new':99B,293C 'object':364C 'one':191C 'op':94B,263C,416C,448C,467C 'open':27A,40B,47B,455C 'open-webui':26A,39B 'pin':246C,378C,451C,462C 'post':4A,63B,110C,127C,144C,221C,243C,321C,342C,424C,441C 'precondit':178C 'proof':408C 'python':42B 'read':98B,214C,291C,432C 'real':139C,289C 'report':481C,486C 'requir':177C 'role':75B,172C,470C 'root':336C 'run':478C 'secret':227C 'see':251C 'self':44B 'self-host':43B 'sent':153C,312C 'server':147C,306C,330C 'set':331C 'setup':349C 'show':163C,464C 'shown':6A,112C,404C 'social':267C 'still':277C 'store':49B,148C,274C,369C,474C 'summari':122C 'suppli':13A,52B,119C 'tarekinh0':485C 'token':106B,176C,300C 'tool':31B 'trust':90B,256C,381C 'upgrad':333C 'use':79B,102B 'via':10A,116C 'webhook':9A,46B,71B,104B,115C,140C,168C,175C,192C,208C,220C,235C,257C,287C,298C,354C,392C,407C,415C,423C,434C,471C 'webui':28A,41B,48B 'without':55B,157C,233C 'write':199C","nicknames":[],"mitigations":[],"who_affected":"Only Open WebUI instances with channels enabled (`ENABLE_CHANNELS` is `false` by default) and at least one channel webhook are exposed. The attacker must be a channel member with write access who knows the webhook id, which any member can read from a message the webhook posted. Instances with channels disabled or without channel webhooks are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openwebui"],"ptokens":["open","webui"],"labels":["aitooling","channels","cwe290","cwe345","cwe863","medium","openwebui","pypi","python","selfhosted","webhooks"],"campaign_type":null,"search_a":"'3vvh':18A,23A 'channel':1A 'client':12A 'client-suppli':11A 'g22g':19A,24A 'ghsa':17A,22A 'ghsa-3vvh-g22g-jq6r':16A,21A 'jq6r':20A,25A 'member':2A 'messag':5A,14A 'metadata':15A 'open':27A 'open-webui':26A 'post':4A 'shown':6A 'suppli':13A 'via':10A 'webhook':9A 'webui':28A","search_b":"'-290':34B '-345':36B '-863':38B 'ai':30B 'ai-tool':29B 'alert':92B 'attack':77B 'bot':95B 'cannot':97B 'channel':32B,60B,70B,84B 'check':56B 'client':51B 'client-suppli':50B 'cwe':33B,35B,37B 'data':100B 'deceiv':82B 'display':67B 'host':45B 'member':61B,85B 'messag':53B,65B 'metadata':54B 'name':73B 'new':99B 'op':94B 'open':40B,47B 'open-webui':39B 'post':63B 'python':42B 'read':98B 'role':75B 'self':44B 'self-host':43B 'store':49B 'suppli':52B 'token':106B 'tool':31B 'trust':90B 'use':79B,102B 'webhook':46B,71B,104B 'webui':41B,48B 'without':55B","search_c":"'0.11.3':483C '0.7.0':356C '1':411C '2':427C '3':439C '32421':304C '4':453C 'accept':360C 'access':200C 'account':281C 'act':295C 'admin':412C 'affect':238C,348C 'alert':261C 'alic':428C,440C,477C 'anyth':292C 'appear':135C 'arbitrari':362C 'attack':194C,205C,279C,283C 'author':275C,475C 'backend/open_webui/routers/channels.py':347C 'bob':454C 'bot':264C,417C,449C,468C 'build':351C 'cannot':284C 'caus':337C 'chang':285C 'channel':107C,130C,143C,161C,179C,183C,187C,203C,230C,234C,271C,340C,353C,420C,430C,457C 'check':158C 'client':118C,152C,315C,367C 'client-suppli':117C 'come':253C 'compon':338C 'concept':410C 'creat':413C 'credit':484C 'decid':385C 'default':184C 'disabl':231C 'drop':308C 'easi':272C 'edit':244C,326C,344C 'enabl':181C,182C 'endpoint':345C 'engin':268C 'enough':335C,398C 'everi':350C 'fals':185C 'fix':301C,302C 'form':359C 'id':210C,393C,435C,446C 'impact':239C 'insid':269C 'instanc':228C 'know':206C 'least':190C 'list':375C,379C,463C 'make':132C,266C 'member':108C,124C,197C,212C,241C,250C,431C 'messag':111C,120C,134C,156C,165C,218C,247C,290C,310C,319C,341C,358C,374C,388C,401C,426C,438C,443C,459C 'meta.webhook':445C 'metadata':121C,150C,311C,363C,383C,396C 'name':170C,447C 'new':293C 'object':364C 'one':191C 'op':263C,416C,448C,467C 'open':455C 'pin':246C,378C,451C,462C 'post':110C,127C,144C,221C,243C,321C,342C,424C,441C 'precondit':178C 'proof':408C 'read':214C,291C,432C 'real':139C,289C 'report':481C,486C 'requir':177C 'role':172C,470C 'root':336C 'run':478C 'secret':227C 'see':251C 'sent':153C,312C 'server':147C,306C,330C 'set':331C 'setup':349C 'show':163C,464C 'shown':112C,404C 'social':267C 'still':277C 'store':148C,274C,369C,474C 'summari':122C 'suppli':119C 'tarekinh0':485C 'token':176C,300C 'trust':256C,381C 'upgrad':333C 'via':116C 'webhook':115C,140C,168C,175C,192C,208C,220C,235C,257C,287C,298C,354C,392C,407C,415C,423C,434C,471C 'without':157C,233C 'write':199C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-18T19:50:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-3vvh-g22g-jq6r","url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-3vvh-g22g-jq6r","severity":"medium","published_at":"2026-10-18T19:50:50+00:00","modified_at":"2026-10-18T19:50:50+00:00","first_seen_at":"2026-11-09T22:53:28+00:00","fetched_at":"2026-11-09T22:53:28+00:00","note":null}],"documents":[{"id":110662,"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-3vvh-g22g-jq6r","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}