[GHSA] GHSA-fmqh-xp37-5hr8 (medium) — Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

GHSA-fmqh-xp37-5hr8 Severity: medium CVE: CVE-2026-87994

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

## Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the