The flaw arises when the function that checks channel membership verifies only the existence of a row but ignores the membership’s is_active flag. A user who has been removed or has left a channel retains a membership record with is_active=False and status='left', yet the API continues to grant full read/write privileges. This allows the deactivated user to read sensitive channel data and post messages, effectively bypassing the intended access controls. The weakness is an access‑control lapse (CWE‑863).

The issue affects all Open WebUI installations prior to version 0.9.0. Any deployment using open-webui:open-webui older than 0.9.0 is vulnerable; the fix is included in the 0.9.0 release and newer versions.

The CVSS score of 5.4 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, so the current public exploitation probability is unknown. Attackers can exploit the flaw by invoking channel‑specific API endpoints that rely on the is_user_channel_member check. Based on the description, the likely attack vector is authenticated or internal, requiring the deactivated user to still possess valid API credentials. An exploit would allow the deactivated member to read confidential channel content and inject messages, leading to potential data leakage or disruption of communication.