[GH-ISSUE #14894] issue: Notes creation and viewing is showing 403 Forbidden error for normal users but works fine for admin user #120706

New Issue

2026-05-20T22:23:47-05:00

GiteaMirror commented

2026-05-20 22:23:47 -05:00

Originally created by @ZaibanAli on GitHub (Jun 11, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/14894

Originally assigned to: @tjbck on GitHub.

Check Existing Issues

I have searched the existing issues and discussions.
I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.6.14

Ollama Version (if applicable)

No response

Operating System

Ubuntu 24.04

Browser (if applicable)

Chrome

Confirmation

I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
Start with the initial platform/version/OS and dependencies used,
Specify exact install/launch/configure commands,
List URLs visited, user input (incl. example values/emails/passwords if needed),
Describe all options and toggles enabled or changed,
Include any files or environmental changes,
Identify the expected and actual result at each stage,
Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

Notes should be able to be viewed and created by normal users when the permission is active for Notes and not only the admin users.

Actual Behavior

403 Forbidden error is shown when the normal user tries to create a note or wants to view the already available one.

GET https://domain.com/api/v1/notes/ff60838b-b865-4d8e-9e66-f4c5020dbdeb 403 (Forbidden)

Steps to Reproduce

Enable the permission for Notes
Create a note from a user other than admin
Error will be shown

Logs & Screenshots

Docker logs:

2025-06-11 19:03:40.836 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 172.23.0.1:42330 - "GET /api/v1/notes/ HTTP/1.1" 200 - {}
2025-06-11 19:03:41.763 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 172.23.0.1:42330 - "GET /api/v1/notes/0de5b52e-c4ee-45a2-8ee6-32730895b1bf HTTP/1.1" 403 - {}
2025-06-11 19:03:41.874 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 172.23.0.1:42330 - "GET /api/v1/users/user/settings HTTP/1.1" 200 - {}

In browser console:
GET https://domain.com/api/v1/notes/ff60838b-b865-4d8e-9e66-f4c5020dbdeb **403 (Forbidden)**

Additional Information

No response

Originally created by @ZaibanAli on GitHub (Jun 11, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/14894 Originally assigned to: @tjbck on GitHub. ### Check Existing Issues - [x] I have searched the existing issues and discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.6.14 ### Ollama Version (if applicable) _No response_ ### Operating System Ubuntu 24.04 ### Browser (if applicable) Chrome ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior Notes should be able to be viewed and created by normal users when the permission is active for Notes and not only the admin users. ### Actual Behavior 403 Forbidden error is shown when the normal user tries to create a note or wants to view the already available one. `GET https://domain.com/api/v1/notes/ff60838b-b865-4d8e-9e66-f4c5020dbdeb 403 (Forbidden)` ### Steps to Reproduce - Enable the permission for Notes - Create a note from a user other than admin - Error will be shown ### Logs & Screenshots **Docker logs:** ``` 2025-06-11 19:03:40.836 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.23.0.1:42330 - "GET /api/v1/notes/ HTTP/1.1" 200 - {} 2025-06-11 19:03:41.763 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.23.0.1:42330 - "GET /api/v1/notes/0de5b52e-c4ee-45a2-8ee6-32730895b1bf HTTP/1.1" 403 - {} 2025-06-11 19:03:41.874 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 172.23.0.1:42330 - "GET /api/v1/users/user/settings HTTP/1.1" 200 - {} ``` **In browser console:** `GET https://domain.com/api/v1/notes/ff60838b-b865-4d8e-9e66-f4c5020dbdeb **403 (Forbidden)**` ### Additional Information _No response_

GiteaMirror added the bug label 2026-05-20 22:23:47 -05:00

GiteaMirror closed this issue

2026-05-20 22:23:49 -05:00

GiteaMirror commented

2026-05-20 22:23:50 -05:00