Open WebUI, a self‑hosted AI platform, has a flaw that allows any authenticated user to overwrite the content of a message in a channel they do not belong to, including private and direct‑message channels. The vulnerability arises when a chat completion request includes a channel‑prefixed chat_id and a target message_id; the server routes the output through _make_channel_emitter and writes to the Messages table using the supplied message_id without verifying channel membership. This permits an attacker to tamper with messages, compromising confidentiality and integrity and potentially facilitating social‑engineering attacks. The weakness is a missing authorization check, classified as CWE‑862.

The affected product is Open WebUI from the open-webui:open-webui vendor. Versions from 0.9.5 up to, but not including, 0.10.0 are vulnerable. Users running any 0.9.5‑0.9.9 release should consider this vulnerability.

The CVSS score of 7.1 indicates a high impact flaw. The exploit requires only user authentication and access to the chat completion API; no additional privileges or network exposure are needed. Because the EPSS score is not available and the vulnerability is not listed in the KEV catalog, it is uncertain how frequently it is exploited, but the potential for data tampering in confidential channels is significant.