fix(auth): enforce settings.interface permission on /user/settings/update endpoint (#25996)

backend/open_webui/routers/users.py

@@ -324,6 +324,14 @@ async def update_user_settings_by_session_user(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    if user.role != 'admin' and not await has_permission(
+        user.id, 'settings.interface', request.app.state.config.USER_PERMISSIONS
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+        )
+
     updated_user_settings = form_data.model_dump()
     ui_settings = updated_user_settings.get('ui')
     if (