[PR #12894] [MERGED] security/fix: prevent email and password changes to the primary admin account #38676

New Issue

GiteaMirror · 2026-04-25T11:35:00-05:00

GiteaMirror commented

2026-04-25 11:35:00 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/12894
Author: @Classic298
Created: 4/15/2025
Status: ✅ Merged
Merged: 4/18/2025
Merged by: @tjbck

Base: dev ← Head: patch-2

📝 Commits (1)

4f14b17 Update users.py

📊 Changes

1 file changed (+27 additions, -0 deletions)

View changed files

📝 backend/open_webui/routers/users.py (+27 -0)

📄 Description

Pull Request Checklist

Note to first-time contributors: Please open a discussion post in Discussions and describe your changes before submitting a pull request.

Before submitting, make sure you've checked the following:

Target branch: Please verify that the pull request targets the dev branch.
Description: Provide a concise description of the changes made in this pull request.
Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
Testing: Have you written and run sufficient tests to validate the changes?
Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?

Changelog Entry

Description

This pull request addresses a security vulnerability where administrative users (other than the primary admin) could modify sensitive details (like email, password) or delete the primary administrative user account (identified as the 'first user'). The fix introduces checks in the user update and delete API endpoints to prevent these actions, aligning the protection level with the existing /users/update/role endpoint.

Security

Prevented modification of primary admin: Added a check to the /users/{user_id}/update endpoint to prevent admins from modifying the user identified by Users.get_first_user(), unless the requesting admin is that first user.
Prevented deletion of primary admin: Added a check to the /users/{user_id}/delete endpoint to prevent any admin from deleting the user identified by Users.get_first_user().

Breaking Changes

BREAKING CHANGE: [List any breaking changes affecting compatibility or functionality]

Additional Information

This change ensures consistent protection for the primary administrator account across different user management actions (role change, profile update, deletion).
The primary administrator is identified using the Users.get_first_user() method.
No manual testing of this PR has been done yet.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/12894 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 4/15/2025 **Status:** ✅ Merged **Merged:** 4/18/2025 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `dev` ← **Head:** `patch-2` --- ### 📝 Commits (1) - [`4f14b17`](https://github.com/open-webui/open-webui/commit/4f14b17c34f5b5e6ed18878eff349c71fa053600) Update users.py ### 📊 Changes **1 file changed** (+27 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/users.py` (+27 -0) </details> ### 📄 Description # Pull Request Checklist ### Note to first-time contributors: Please open a discussion post in [Discussions](https://github.com/open-webui/open-webui/discussions) and describe your changes before submitting a pull request. **Before submitting, make sure you've checked the following:** - [X] **Target branch:** Please verify that the pull request targets the `dev` branch. - [X] **Description:** Provide a concise description of the changes made in this pull request. - [X] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description. - [ ] **Testing:** Have you written and run sufficient tests to validate the changes? - [X] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards? # Changelog Entry ### Description - This pull request addresses a security vulnerability where administrative users (other than the primary admin) could modify sensitive details (like email, password) or delete the primary administrative user account (identified as the 'first user'). The fix introduces checks in the user update and delete API endpoints to prevent these actions, aligning the protection level with the existing `/users/update/role` endpoint. ### Security - **Prevented modification of primary admin:** Added a check to the `/users/{user_id}/update` endpoint to prevent admins from modifying the user identified by `Users.get_first_user()`, unless the requesting admin *is* that first user. - **Prevented deletion of primary admin:** Added a check to the `/users/{user_id}/delete` endpoint to prevent any admin from deleting the user identified by `Users.get_first_user()`. ### Breaking Changes - **BREAKING CHANGE**: [List any breaking changes affecting compatibility or functionality] --- ### Additional Information - This change ensures consistent protection for the primary administrator account across different user management actions (role change, profile update, deletion). - The primary administrator is identified using the `Users.get_first_user()` method. - **No manual testing of this PR has been done yet.** --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-25 11:35:00 -05:00

GiteaMirror closed this issue

2026-04-25 11:35:01 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#38676