I have searched for any existing and/or related issues.
I have searched for any existing and/or related discussions.
I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
I am using the latest version of Open WebUI.
Installation Method
Git Clone
Open WebUI Version
v0.6.41
Ollama Version (if applicable)
No response
Operating System
WSL
Browser (if applicable)
No response
Confirmation
I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
Start with the initial platform/version/OS and dependencies used,
Specify exact install/launch/configure commands,
List URLs visited, user input (incl. example values/emails/passwords if needed),
Describe all options and toggles enabled or changed,
Include any files or environmental changes,
Identify the expected and actual result at each stage,
Ensure any reasonably skilled user can follow and hit the same issue.
Expected Behavior
When a user does not have permission to use Channels, Channels should not be initialized or requested at all.
For example, the Folders feature is validated before folders are fetched:
When a user does not have permission to access Channels, the frontend still requests Channels on every load and the backend responds with 401 Unauthorized
No client-side validation is performed, unlike the Folders feature:
constinitChannels=async()=>{// default (none), group, dm type
constres=awaitgetChannels(localStorage.token).catch((error)=>{returnnull;});if(res){awaitchannels.set(res.sort((a,b)=>['',null,'group','dm'].indexOf(a.type)-['',null,'group','dm'].indexOf(b.type)));}};
Start a new Open WebUI instance. (default configs, dev or main)
Disable Channels in the default permissions.
Create a user with the "user" role.
Log in as that user.
Open the browser DevTools and observe a 401 error in the Network tab.
Logs & Screenshots
Additional Information
P.S. I'm aware of the bug on main right now where the same call causes chats not to load due to the lack of a try-catch; this is fixed on dev. The call itself still occurs on dev, though. 😄
Additionally, Folders also return a 403 on every load when Folders are disabled for a user, because the validation only checks the config and not the user’s permissions. Is this intended?
Originally created by @rozatoo on GitHub (Dec 12, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/19913
### Check Existing Issues
- [x] I have searched for any existing and/or related issues.
- [x] I have searched for any existing and/or related discussions.
- [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
- [x] I am using the latest version of Open WebUI.
### Installation Method
Git Clone
### Open WebUI Version
v0.6.41
### Ollama Version (if applicable)
_No response_
### Operating System
WSL
### Browser (if applicable)
_No response_
### Confirmation
- [x] I have read and followed all instructions in `README.md`.
- [x] I am using the latest version of **both** Open WebUI and Ollama.
- [x] I have included the browser console logs.
- [x] I have included the Docker container logs.
- [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.**
- [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
- [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps:
- Start with the initial platform/version/OS and dependencies used,
- Specify exact install/launch/configure commands,
- List URLs visited, user input (incl. example values/emails/passwords if needed),
- Describe all options and toggles enabled or changed,
- Include any files or environmental changes,
- Identify the expected and actual result at each stage,
- Ensure any reasonably skilled user can follow and hit the same issue.
### Expected Behavior
When a user does not have permission to use Channels, Channels should not be initialized or requested at all.
For example, the Folders feature is validated before folders are fetched:
```javascript
const initFolders = async () => {
if ($config?.features?.enable_folders === false) {
return;
}
...
}
```
### Actual Behavior
When a user does not have permission to access Channels, the frontend still requests Channels on every load and the backend responds with 401 Unauthorized
No client-side validation is performed, unlike the Folders feature:
```javascript
const initChannels = async () => {
// default (none), group, dm type
const res = await getChannels(localStorage.token).catch((error) => {
return null;
});
if (res) {
await channels.set(
res.sort(
(a, b) =>
['', null, 'group', 'dm'].indexOf(a.type) - ['', null, 'group', 'dm'].indexOf(b.type)
)
);
}
};
```
Potential validation:
```javascript
if (!$config?.features?.enable_channels || ($user?.role !== 'admin' && !$user?.permissions?.features?.channels)) {
return;
}
```
### Steps to Reproduce
1. Start a new Open WebUI instance. (default configs, dev or main)
2. Disable Channels in the default permissions.
3. Create a user with the "user" role.
4. Log in as that user.
5. Open the browser DevTools and observe a 401 error in the Network tab.
### Logs & Screenshots
<img width="582" height="228" alt="Image" src="https://github.com/user-attachments/assets/43b31df8-e1a9-4286-864e-ab856c2883f1" />
### Additional Information
P.S. I'm aware of the bug on main right now where the same call causes chats not to load due to the lack of a try-catch; this is fixed on dev. The call itself still occurs on dev, though. 😄
Additionally, Folders also return a 403 on every load when Folders are disabled for a user, because the validation only checks the config and not the user’s permissions. Is this intended?
GiteaMirror
added the bug label 2026-05-15 14:46:22 -05:00
If this is a duplicate, please consider closing this issue and adding any additional details to the existing one
If you found a solution in any of these issues, please share it here to help others
This comment was generated automatically by a bot. Please react with a 👍 if this comment was helpful, or a 👎 if it was not.
<!-- gh-comment-id:3646637745 -->
@owui-terminator[bot] commented on GitHub (Dec 12, 2025):
🔍 **Similar Issues Found**
I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions:
1. [#19588](https://github.com/open-webui/open-webui/issues/19588) **issue: Model group permissions**
*by apunkt • Nov 29, 2025 • `bug`*
2. [#19758](https://github.com/open-webui/open-webui/issues/19758) **issue: unable to disable channels creation from regular users**
*by stronk7 • Dec 04, 2025 • `bug`*
3. [#19877](https://github.com/open-webui/open-webui/issues/19877) **issue:**
*by dotmobo • Dec 11, 2025 • `bug`*
4. [#19861](https://github.com/open-webui/open-webui/issues/19861) **issue:**
*by QuitHub • Dec 10, 2025 • `bug`*
5. [#19864](https://github.com/open-webui/open-webui/issues/19864) **issue:**
*by Haervwe • Dec 10, 2025 • `bug`*
<details>
<summary>Show 5 more related issues</summary>
6. [#19777](https://github.com/open-webui/open-webui/issues/19777) **issue:**
*by Yaute7 • Dec 05, 2025 • `bug`*
7. [#19563](https://github.com/open-webui/open-webui/issues/19563) **issue:**
*by naruto7g • Nov 28, 2025 • `bug`*
8. [#19103](https://github.com/open-webui/open-webui/issues/19103) **issue: no response from the model when ask in "channels"**
*by silenceroom • Nov 11, 2025 • `bug`*
9. [#18974](https://github.com/open-webui/open-webui/issues/18974) **issue: hanging on front matter requirements after update**
*by DuckyBlender • Nov 06, 2025 • `bug`*
10. [#19211](https://github.com/open-webui/open-webui/issues/19211) **issue:**
*by Byrnes9 • Nov 16, 2025 • `bug`*
</details>
---
💡 **Tips:**
- If this is a duplicate, please consider closing this issue and adding any additional details to the existing one
- If you found a solution in any of these issues, please share it here to help others
*This comment was generated automatically by a bot.* Please react with a 👍 if this comment was helpful, or a 👎 if it was not.
Hi @Classic298, I also noticed that users with channel permissions are able to fetch channels even when channels are globally disabled, is that a bug? (Frontend doesn't display them but call returns channels)
<!-- gh-comment-id:3646679508 -->
@rozatoo commented on GitHub (Dec 12, 2025):
Hi @Classic298, I also noticed that users with channel permissions are able to fetch channels even when channels are globally disabled, is that a bug? (Frontend doesn't display them but call returns channels)
@rozatoo interesting..pls open a new issue for this with reproduction steps
<!-- gh-comment-id:3646746103 -->
@Classic298 commented on GitHub (Dec 12, 2025):
@rozatoo interesting..pls open a new issue for this with reproduction steps
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @rozatoo on GitHub (Dec 12, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/19913
Check Existing Issues
Installation Method
Git Clone
Open WebUI Version
v0.6.41
Ollama Version (if applicable)
No response
Operating System
WSL
Browser (if applicable)
No response
Confirmation
README.md.Expected Behavior
When a user does not have permission to use Channels, Channels should not be initialized or requested at all.
For example, the Folders feature is validated before folders are fetched:
Actual Behavior
When a user does not have permission to access Channels, the frontend still requests Channels on every load and the backend responds with 401 Unauthorized
No client-side validation is performed, unlike the Folders feature:
Potential validation:
Steps to Reproduce
Logs & Screenshots
Additional Information
P.S. I'm aware of the bug on main right now where the same call causes chats not to load due to the lack of a try-catch; this is fixed on dev. The call itself still occurs on dev, though. 😄
Additionally, Folders also return a 403 on every load when Folders are disabled for a user, because the validation only checks the config and not the user’s permissions. Is this intended?
@owui-terminator[bot] commented on GitHub (Dec 12, 2025):
🔍 Similar Issues Found
I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions:
#19588 issue: Model group permissions
by apunkt • Nov 29, 2025 •
bug#19758 issue: unable to disable channels creation from regular users
by stronk7 • Dec 04, 2025 •
bug#19877 issue:
by dotmobo • Dec 11, 2025 •
bug#19861 issue:
by QuitHub • Dec 10, 2025 •
bug#19864 issue:
by Haervwe • Dec 10, 2025 •
bugShow 5 more related issues
#19777 issue:
by Yaute7 • Dec 05, 2025 •
bug#19563 issue:
by naruto7g • Nov 28, 2025 •
bug#19103 issue: no response from the model when ask in "channels"
by silenceroom • Nov 11, 2025 •
bug#18974 issue: hanging on front matter requirements after update
by DuckyBlender • Nov 06, 2025 •
bug#19211 issue:
by Byrnes9 • Nov 16, 2025 •
bug💡 Tips:
This comment was generated automatically by a bot. Please react with a 👍 if this comment was helpful, or a 👎 if it was not.
@Classic298 commented on GitHub (Dec 12, 2025):
Fixed in dev afaik
@Classic298 commented on GitHub (Dec 12, 2025):
(that the call is still there is not a bug)
@rozatoo commented on GitHub (Dec 12, 2025):
Hi @Classic298, I also noticed that users with channel permissions are able to fetch channels even when channels are globally disabled, is that a bug? (Frontend doesn't display them but call returns channels)
@Classic298 commented on GitHub (Dec 12, 2025):
@rozatoo interesting..pls open a new issue for this with reproduction steps