7c49fc0 fix(chats): allow admins to manage shared chat access
📊 Changes
1 file changed (+19 additions, -6 deletions)
View changed files
📝backend/open_webui/routers/chats.py (+19 -6)
📄 Description
Summary
Resolve shared chat access-management targets before applying the owner/admin authorization check.
Allow admins to view/update access grants for shared chats owned by another user instead of returning 404 from an owner-only lookup.
Store and read shared-chat grants against the original chat id even when the route receives a share id.
Why
The shared chat access endpoints loaded chats with get_chat_by_id_and_user_id(id, user.id) before checking whether the requester is an admin. That means an admin managing another user's shared chat could be rejected before the admin bypass was evaluated.
This keeps the existing owner/admin guard, but first resolves either the original chat id or the shared-chat id to the canonical chat and access-grant resource id.
Full pytest/ruff were not run locally because this checkout does not have the project's Python dev dependencies installed (typer, ruff, etc.).
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/24538
**Author:** [@zuyua9](https://github.com/zuyua9)
**Created:** 5/10/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `fix/shared-chat-admin-acl-zuyua9`
---
### 📝 Commits (1)
- [`7c49fc0`](https://github.com/open-webui/open-webui/commit/7c49fc06b934f9214bbea811bded907408d646ac) fix(chats): allow admins to manage shared chat access
### 📊 Changes
**1 file changed** (+19 additions, -6 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/routers/chats.py` (+19 -6)
</details>
### 📄 Description
## Summary
- Resolve shared chat access-management targets before applying the owner/admin authorization check.
- Allow admins to view/update access grants for shared chats owned by another user instead of returning 404 from an owner-only lookup.
- Store and read shared-chat grants against the original chat id even when the route receives a share id.
## Why
The shared chat access endpoints loaded chats with `get_chat_by_id_and_user_id(id, user.id)` before checking whether the requester is an admin. That means an admin managing another user's shared chat could be rejected before the admin bypass was evaluated.
This keeps the existing owner/admin guard, but first resolves either the original chat id or the shared-chat id to the canonical chat and access-grant resource id.
## Validation
- `python3 -m compileall -q backend/open_webui/routers/chats.py`
- `git diff --check`
Full pytest/ruff were not run locally because this checkout does not have the project's Python dev dependencies installed (`typer`, `ruff`, etc.).
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/24538
Author: @zuyua9
Created: 5/10/2026
Status: ❌ Closed
Base:
main← Head:fix/shared-chat-admin-acl-zuyua9📝 Commits (1)
7c49fc0fix(chats): allow admins to manage shared chat access📊 Changes
1 file changed (+19 additions, -6 deletions)
View changed files
📝
backend/open_webui/routers/chats.py(+19 -6)📄 Description
Summary
Why
The shared chat access endpoints loaded chats with
get_chat_by_id_and_user_id(id, user.id)before checking whether the requester is an admin. That means an admin managing another user's shared chat could be rejected before the admin bypass was evaluated.This keeps the existing owner/admin guard, but first resolves either the original chat id or the shared-chat id to the canonical chat and access-grant resource id.
Validation
python3 -m compileall -q backend/open_webui/routers/chats.pygit diff --checkFull pytest/ruff were not run locally because this checkout does not have the project's Python dev dependencies installed (
typer,ruff, etc.).🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.