[API] /user/{user_id}/update permission problem #2328

New Issue

2025-11-11T15:05:10-06:00

GiteaMirror commented

2025-11-11 15:05:10 -06:00

Originally created by @fraciscoestar on GitHub (Oct 9, 2024).

Feature Request

Is your feature request related to a problem? Please describe.
I am using the Open WebUI API to provide a client for a VSCode extension. I was trying to let the user change its avatar from here but I have encountered a problem. The user don't have permission to update itself.

Describe the solution you'd like
Any user should have permission to update itself in [POST] /users/{user_id}/update. Any user may only be capable of updating itself and not any other user unless the user role is admin.

Describe alternatives you've considered
Another solution for my problem may be to store an admin API key in the client but that may be a high security risk.

Additional context
The API requests use the JWT session token of the users.
Request to change icon:

curl -X 'POST' \
  'http://127.0.0.1:8080/api/v1/users/USER_ID/update' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer JWT_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "test",
  "email": "test@test.test",
  "profile_image_url": "IMAGE_BASE64"
}'

Response:

{
  "detail": "You do not have permission to access this resource. Please contact your administrator for assistance."
}

Originally created by @fraciscoestar on GitHub (Oct 9, 2024). # Feature Request **Is your feature request related to a problem? Please describe.** I am using the Open WebUI API to provide a client for a VSCode extension. I was trying to let the user change its avatar from here but I have encountered a problem. The user don't have permission to update itself. **Describe the solution you'd like** Any user should have permission to update **itself** in *[POST] /users/{user_id}/update*. Any user may only be capable of updating itself and not any other user unless the user role is admin. **Describe alternatives you've considered** Another solution for my problem may be to store an admin API key in the client but that may be a high security risk. **Additional context** The API requests use the JWT session token of the users. **Request to change icon:** ``` curl -X 'POST' \ 'http://127.0.0.1:8080/api/v1/users/USER_ID/update' \ -H 'accept: application/json' \ -H 'Authorization: Bearer JWT_TOKEN' \ -H 'Content-Type: application/json' \ -d '{ "name": "test", "email": "test@test.test", "profile_image_url": "IMAGE_BASE64" }' ``` **Response:** ``` { "detail": "You do not have permission to access this resource. Please contact your administrator for assistance." } ```

GiteaMirror closed this issue

2025-11-11 15:05:10 -06:00

GiteaMirror referenced this issue

2025-11-11 17:35:12 -06:00

[PR #2328] [MERGED] fix: image generation broken by config persistence #7760

GiteaMirror referenced this issue

2026-04-20 03:16:39 -05:00

[PR #2328] [MERGED] fix: image generation broken by config persistence #20964

GiteaMirror referenced this issue

2026-04-25 10:23:58 -05:00

[PR #2328] [MERGED] fix: image generation broken by config persistence #36594

GiteaMirror referenced this issue