PYSEC-2026-3649 Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Summary On standard channels, the message update and delete handlers accepted any caller holding write access on the channel, without checking that the caller wrote the message. Write access is the same grant a member needs in order to post, so every ordinary participant in a shared channel could...

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

SummaryOn standard channels, the message update and delete handlers accepted any caller holding write access on the channel, without checking that the caller wrote the message. Write access is the same grant a member needs in order to post, so every ordinary participant in a shared channel could...

GHSA-MJ5R-JF49-M3W7 Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Summary On standard channels, the message update and delete handlers accepted any caller holding write access on the channel, without checking that the caller wrote the message. Write access is the same grant a member needs in order to post, so every ordinary participant in a shared channel could...

CVE-2026-70481 Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access i...

Conduit Security Vulnerabilities

Conduit is a simple, fast and reliable chat server from the individual developer Timo Kösters. A security vulnerability exists in Conduit v0.6.0 and earlier versions, which stems from a failure to check permissions when handling edits, resulting in a local user being able to edit any message from...

xgb-bypass.txt

/ xGB 2.0 xGB.php Remote Permission Bypass Vulnerability Bug discovered by DarkFuneral http://www.darkfuneral89.altervista.org/ Affected Software: xGB CMS Site: "i don't know! :P" Severity: Critical Description: An attacker can edit all message in xGB Google Dork: allinurl:"xGb.php" E-Mail:...