[GH-ISSUE #6052] [API] /user/{user_id}/update permission problem #14222

New Issue

GiteaMirror · 2026-04-19T20:39:24-05:00

GiteaMirror commented

2026-04-19 20:39:24 -05:00

Originally created by @fraciscoestar on GitHub (Oct 9, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/6052

Feature Request

Is your feature request related to a problem? Please describe.
I am using the Open WebUI API to provide a client for a VSCode extension. I was trying to let the user change its avatar from here but I have encountered a problem. The user don't have permission to update itself.

Describe the solution you'd like
Any user should have permission to update itself in [POST] /users/{user_id}/update. Any user may only be capable of updating itself and not any other user unless the user role is admin.

Describe alternatives you've considered
Another solution for my problem may be to store an admin API key in the client but that may be a high security risk.

Additional context
The API requests use the JWT session token of the users.
Request to change icon:

curl -X 'POST' \
  'http://127.0.0.1:8080/api/v1/users/USER_ID/update' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer JWT_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "test",
  "email": "test@test.test",
  "profile_image_url": "IMAGE_BASE64"
}'

Response:

{
  "detail": "You do not have permission to access this resource. Please contact your administrator for assistance."
}

Originally created by @fraciscoestar on GitHub (Oct 9, 2024). Original GitHub issue: https://github.com/open-webui/open-webui/issues/6052 # Feature Request **Is your feature request related to a problem? Please describe.** I am using the Open WebUI API to provide a client for a VSCode extension. I was trying to let the user change its avatar from here but I have encountered a problem. The user don't have permission to update itself. **Describe the solution you'd like** Any user should have permission to update **itself** in *[POST] /users/{user_id}/update*. Any user may only be capable of updating itself and not any other user unless the user role is admin. **Describe alternatives you've considered** Another solution for my problem may be to store an admin API key in the client but that may be a high security risk. **Additional context** The API requests use the JWT session token of the users. **Request to change icon:** ``` curl -X 'POST' \ 'http://127.0.0.1:8080/api/v1/users/USER_ID/update' \ -H 'accept: application/json' \ -H 'Authorization: Bearer JWT_TOKEN' \ -H 'Content-Type: application/json' \ -d '{ "name": "test", "email": "test@test.test", "profile_image_url": "IMAGE_BASE64" }' ``` **Response:** ``` { "detail": "You do not have permission to access this resource. Please contact your administrator for assistance." } ```

GiteaMirror closed this issue

2026-04-19 20:39:26 -05:00

GiteaMirror referenced this issue

2026-04-20 04:48:48 -05:00

[PR #14222] [CLOSED] fix: S3 allowed characters in Tags. #23415

GiteaMirror referenced this issue

2026-04-25 11:46:38 -05:00

[PR #14222] [CLOSED] fix: S3 allowed characters in Tags. #39045

GiteaMirror referenced this issue

2026-04-29 21:17:32 -05:00

[PR #14222] [CLOSED] fix: S3 allowed characters in Tags. #46463

GiteaMirror referenced this issue