[PR #23625] [MERGED] fix: add missing read-access check on channel members endpoint #66140

New Issue

GiteaMirror · 2026-05-06T12:18:02-05:00

GiteaMirror commented

2026-05-06 12:18:02 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/23625
Author: @Classic298
Created: 4/12/2026
Status: ✅ Merged
Merged: 4/12/2026
Merged by: @tjbck

Base: dev ← Head: fix/channel-members-access-check

📝 Commits (1)

6235355 fix: add missing read-access check on channel members endpoint

📊 Changes

1 file changed (+3 additions, -0 deletions)

View changed files

📝 backend/open_webui/routers/channels.py (+3 -0)

📄 Description

The GET /channels/{id}/members endpoint checked membership for group/dm channels but had no access gate for standard channels, allowing any authenticated user with channels permission to enumerate members of private standard channels by UUID.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/23625 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 4/12/2026 **Status:** ✅ Merged **Merged:** 4/12/2026 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `dev` ← **Head:** `fix/channel-members-access-check` --- ### 📝 Commits (1) - [`6235355`](https://github.com/open-webui/open-webui/commit/6235355eeed6ed74fe670f2ff99d6f2b3819a413) fix: add missing read-access check on channel members endpoint ### 📊 Changes **1 file changed** (+3 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/channels.py` (+3 -0) </details> ### 📄 Description The GET /channels/{id}/members endpoint checked membership for group/dm channels but had no access gate for standard channels, allowing any authenticated user with channels permission to enumerate members of private standard channels by UUID. ### Contributor License Agreement  - [X] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-06 12:18:02 -05:00

GiteaMirror closed this issue

2026-05-06 12:18:10 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#66140