Incorrect Authorization Affecting open-webui package, versions [,0.9.0)

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization in the set_access_grants process. An attacker can override administrative access controls by submitting arbitrary access grants, including wildcard grants, which are persisted without proper filtering. This allows unauthorized users to make channels publicly accessible or grant access to individual users, even when such actions are restricted by administrative policy. This is only exploitable if the attacker has an account with permission to create group channels or owns an existing channel, and the administrator has configured restrictive sharing permissions for regular users.

• GitHub Advisory
• GitHub Commit