CVE-2026-59222CWE-200

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Medium · published July 9, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-07-09T16:59Z
EPSS history
Timeline
  • 09 JUL 16:59Z
    Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials
    cvelistv5