Am I affected by Open WebUI: Channel members can overwrite another member's message via the chat…? What should I do?
Any member of a channel who can post to it could also replace the text of a message written by a different member.
Affected: open-webui >= 0.9.5, < 0.11.1. Fixed in: 0.11.1. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-87994-open-webui (opens external site)
1 answer
Am I affected? Affected: open-webui >= 0.9.5, < 0.11.1. Fixed in: 0.11.1.
- Check your version: run
pip show open-webui. Versions >= 0.9.5, < 0.11.1 of open-webui are affected.
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "open-webui>=0.11.1"(first patched version 0.11.1). - Upgrade to 0.11.1, which fully resolves this.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-fmqh-xp37-5hr8 (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-87994-open-webui (opens external site)
Did this work for you?- Check your version: run