This vulnerability allows an authenticated member of a channel to overwrite a message posted by another member using the chat completions endpoint. The endpoint fails to verify that the caller is the original author of the targeted message, so the message content can be replaced while preserving the original author metadata. This gives an attacker the ability to inject erroneous or malicious content into a conversation without revealing their identity, compromising the integrity of the channel’s dialogue.

Open WebUI, versions 0.9.5 through 0.11.1 on the channel branch of the chat_completion endpoint. The bug was addressed in the 0.11.1 release, so any instance running a version older than 0.11.1 is vulnerable.

The CVSS score of 4.3 indicates moderate risk. Because the vulnerability requires the attacker to be a legitimate channel member with write permission, the attack surface is limited to authorized users. No known public exploits exist and the vendor has not listed the issue in the CISA KEV catalog. Nevertheless, an organization should consider that a malicious insider could manipulate conversations and potentially influence user decisions.