[PR #22430] [CLOSED] fix: public-read access grant should not confer write access to notes #42317

New Issue

GiteaMirror · 2026-04-25T14:15:43-05:00

GiteaMirror commented

2026-04-25 14:15:43 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/22430
Author: @gambletan
Created: 3/8/2026
Status: ❌ Closed

Base: dev ← Head: dev

📝 Commits (1)

205b3bc fix: remove incorrect public-read grant from note write_access check

📊 Changes

1 file changed (+0 additions, -1 deletions)

View changed files

📝 backend/open_webui/routers/notes.py (+0 -1)

📄 Description

Description

The has_public_read_access_grant() check was incorrectly included in the write access calculation. This meant that any user with public read access could also gain write access to notes, resulting in a privilege escalation vulnerability.

Fixed

Removed has_public_read_access_grant() from the write access logic so that public read access no longer confers write access to notes.

Additional Information

Tested by reviewing the code path and verifying the fix addresses the issue
Self-reviewed the code changes

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/22430 **Author:** [@gambletan](https://github.com/gambletan) **Created:** 3/8/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `dev` --- ### 📝 Commits (1) - [`205b3bc`](https://github.com/open-webui/open-webui/commit/205b3bc24ac0727b3e636cce9bbff2165b0eda76) fix: remove incorrect public-read grant from note write_access check ### 📊 Changes **1 file changed** (+0 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/notes.py` (+0 -1) </details> ### 📄 Description ### Description - The `has_public_read_access_grant()` check was incorrectly included in the write access calculation. This meant that any user with public read access could also gain write access to notes, resulting in a privilege escalation vulnerability. ### Fixed - Removed `has_public_read_access_grant()` from the write access logic so that public read access no longer confers write access to notes. ### Additional Information - Tested by reviewing the code path and verifying the fix addresses the issue - Self-reviewed the code changes ### Contributor License Agreement - [x] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-25 14:15:43 -05:00

GiteaMirror closed this issue

2026-04-25 14:15:44 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#42317