CVE-2026-59222: Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

The channel members handler builds its response with UserModelResponse(**user.model_dump(), is_active=...) in both the DM and non-DM code paths. UserModel in models/users.py carries a UserSettings object and free-form settings.ui configuration, so all of it goes out to every participant. The normal profile route, /api/v1/users/{user_id}/info, does not return these fields.

The attacker needs channels enabled (the Channels beta setting) and a low-privilege account. They create a DM with the target, for example an admin, then open the members view. The browser's request to /api/v1/channels/{id}/members returns the other member's settings, including toolServers and their key values.

What they get: webhook notification URLs and the bearer tokens for tool servers that the victim configured. Those tokens may open access to internal services and MCP-style tool backends the tool server fronts. The CVSS 4.0 vector rates confidentiality as high and nothing else.

The open-webui pip package, versions >= 0.7.0, < 0.10.0. The flaw matters only when Channels (Beta) is enabled under Admin Panel > Settings > General, since the endpoint belongs to the channels feature.

pip show open-webui

For Docker, check the image tag. Users who saved tool server keys or webhook URLs in their settings are the ones whose secrets leak.

Upgrade to open-webui 0.10.0.

pip install --upgrade open-webui==0.10.0

The advisory names no workaround. Turning Channels off removes the endpoint from use. Because the keys may already have been read, rotate tool server bearer tokens and webhook URLs stored in user settings after upgrading.

Check access logs for GET /api/v1/channels/{id}/members calls from low-privilege users, especially in DMs created with admin accounts or created just before the call. Then look for use of the leaked secrets: requests to your tool servers or webhook endpoints from unexpected source addresses, or with the bearer token from a client other than Open WebUI.

Summary

The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (settings.ui.toolServers[].key), which is not available via standard user info APIs.

Details

The endpoint GET /api/v1/channels/{id}/members returns the full serialized user model for every member in the channel. In both the DM and non-DM code paths, the handler constructs the response with [UserModelResponse(**user.model_dump(), is_active=...)] and returns it as the users list. Because UserModel (models/users.py) includes a settings object (UserSettings) and arbitrary UI configuration (settings.ui), the endpoint exposes other users' sensitive configuration to any channel participant.

Practically, a regular user who participates in a DM or group can call /api/v1/channels/{id}/members and receive other members' settings, including admin-only details such as webhook notification URLs and tool server configuration, including credential fields like settings.ui.toolServers[].key. These values are not returned by the normal user profile endpoints (e.g., /api/v1/users/{user_id}/info).

PoC

1. Start a local Open WebUI instance
2. Log in as admin and in the Admin Panel, go to Settings -> General and check *Channels (Beta)*, then press Save.
3. Create a low-privilege user in the Users tab
4. Click on the admin's profile bottom left, Settings and Integrations. Then click the + after *Manage Tool Servers* to add some tool server with a secret Bearer token (eg. KEY)
5. Log in as the attacker with the low-privilege account and create a new Direct Message channel with the admin user:

1. After creating, open DevTools with F12 and go to the Network tab. Then in the DM UI click on the *Users* icon top right to see the members. In the network tab, this should have triggered a /api/v1/channels/{id}/members request which responds with the settings key including toolServers and key values:

The attacker has now leaked the admin's bearer token for the toolserver they configured.

Impact

Conditions for exploit: channels are enabled and an attacker has a low-privilege account.

Webhook URLs and tool server configurations (including bearer keys) can be exfiltrated from any user.

Original Agent Report