CVE-2026-26192 Patch Review: Bandaid Fix with Unrelated Access-Control Changes

Vulnerability

NVD, CVE, and the vendor advisory GHSA-XC8P-9RR6-97R2 describe a stored cross-site scripting issue in Open WebUI before 0.7.0. The reported attack path is low-privileged manipulation of chat-history citations that are later rendered inside an insecurely sandboxed iframe, enabling administrator session hijack when privileged users view the poisoned content.

For this class of bug, a convincing fix would normally be expected to change one or more of the following: citation content sanitization, HTML rendering policy, iframe sandbox flags, origin isolation, or message/citation serialization paths. In the provided commit reference 6f1486ffd0cb288d0e21f41845361924e0d742b3, the visible snippets do not show such changes.

Patch

The supplied diff excerpts are dominated by unrelated or weakly related modifications:

• Model write-permission filtering was refactored in backend/open_webui/models/models.py to OR owner and group-based access checks.
• backend/open_webui/routers/models.py now populates group_ids from the current user's memberships.
• backend/open_webui/routers/users.py changes a Pydantic model to allow extra fields.
• src/lib/components/AddToolServerModal.svelte and backend/open_webui/utils/middleware.py normalize function_name_filter_list handling from array/string inconsistencies.
• A locale translation file was updated.

The most substantial code shown is access-control logic, not XSS mitigation:

def _has_write_permission(self, query, filter: dict):
        if filter.get("group_ids") or filter.get("user_id"):
            conditions = []

            if filter.get("group_ids"):
                group_ids = filter["group_ids"]
                like_clauses = []

                for gid in group_ids:
                    like_clauses.append(
                        cast(Model.access_control, String).like(
                            f'%"write"%"group_ids"%"{gid}"%'
                        )
                    )

                conditions.append(or_(*like_clauses))

            if filter.get("user_id"):
                conditions.append(Model.user_id == filter["user_id"])

            query = query.filter(or_(*conditions))

        return query

None of the provided snippets show changes to iframe creation, sandbox attributes, citation rendering, HTML sanitization, or CSP. That absence is material because the vulnerability summary explicitly centers on insecure iframe sandboxing and stored citation content.

Review

Pros

• The commit at the referenced patch appears to improve some authorization and configuration-handling paths, which may reduce separate correctness or privilege-boundary issues.
• The function_name_filter_list normalization reduces type ambiguity between frontend and backend, which is good defensive engineering.
• The model-sharing changes may fix a distinct access-control bug by explicitly accounting for group membership in write checks.

Cons

• The visible patch content is not source-aligned with the documented root cause for CVE-2026-26192. There is no shown remediation for insecure iframe sandboxing.
• No provided snippet demonstrates sanitization or encoding of attacker-controlled citation content before rendering.
• No provided snippet shows removal of dangerous iframe capabilities such as script execution or same-origin combinations, which are central to iframe-based XSS containment failures.
• The addition of ConfigDict(extra="allow") in user-related schema handling is orthogonal to the reported issue and potentially broadens accepted input surface rather than constraining it.
• Because the patch evidence is misaligned, it is not possible from the supplied sources to verify that administrator session hijack via stored citations is actually prevented.

Verdict

Bandaid.

Based strictly on the supplied sources, this patch set does not demonstrate a root-cause fix for the stored XSS described by CVE-2026-26192 and GHSA-XC8P-9RR6-97R2. The diff excerpts are largely unrelated to citation rendering or iframe sandbox policy, so the review outcome is negative: either the wrong commit is referenced for this CVE, or the provided patch summary is incomplete. Engineers should require evidence of changes in the rendering path that enforce safe sandbox attributes, sanitize or strip active content from citations, and ideally add regression tests proving that stored citation payloads cannot execute in an administrator context.