CVE-2026-59215: Insecure Direct Object Reference in Open WebUI Thread Message Lookup

Vulnerability ID: CVE-2026-59215
CVSS Score: 3.1
Published: 2026-07-24

A Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR) vulnerability in Open WebUI prior to v0.10.0 allows authenticated users to access and disclose private message contents, thread context, and channel metadata from other restricted private or Direct Message (DM) channels without proper authorization.

TL;DR

Authenticated users can read private messages and channel threads they do not own by exploiting missing channel-binding validation in thread parent-message lookups.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-639 (Authorization Bypass Through User-Controlled Key)
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 3.1 (Low)
• Exploit Status: None / Proof-of-Concept
• Affected Versions: < v0.10.0
• Fixed Version: v0.10.0

Affected Systems

• Open WebUI
• Open WebUI: < v0.10.0 (Fixed in: v0.10.0)

Code Analysis

Commit: a66477b

Fix thread and message channel validation

Mitigation Strategies

• Upgrade Open WebUI to version v0.10.0 or higher.
• Audit application logs for unusual patterns of cross-channel message queries.

Remediation Steps:

1. Identify running Open WebUI container or local deployment.
2. Update the deployment image or pull the latest source code corresponding to version >= v0.10.0.
3. Restart the service and verify that the /thread API endpoints validate correct channel binding.

References

• GitHub Security Advisory GHSA-73x5-h92w-xc2j
• Official Fix Commit
• Official Pull Request #25766
• Open WebUI v0.10.0 Release Notes
• NVD Vulnerability Detail
• CVEproject Authoritative Entry

---

Read the full report for CVE-2026-59215 on our website for more details including interactive diagrams and full exploit analysis.