From 71a39dbac1208e31e885a1e0309d016da47c7f76 Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Sun, 12 Apr 2026 18:13:51 +0200 Subject: [PATCH] fix: filter on is_active in channel membership checks (#23623) is_user_channel_member and is_user_channel_manager did not filter on is_active, allowing deactivated members to retain read/write access to group channels via direct API calls. --- backend/open_webui/models/channels.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/backend/open_webui/models/channels.py b/backend/open_webui/models/channels.py index 4d773491d..10f2e5cad 100644 --- a/backend/open_webui/models/channels.py +++ b/backend/open_webui/models/channels.py @@ -508,6 +508,7 @@ class ChannelTable: .filter( ChannelMember.channel_id == channel_id, ChannelMember.user_id == user_id, + ChannelMember.is_active.is_(True), ChannelMember.role == 'manager', ) .first() @@ -667,6 +668,7 @@ class ChannelTable: .filter( ChannelMember.channel_id == channel_id, ChannelMember.user_id == user_id, + ChannelMember.is_active.is_(True), ) .first() )