From 3c67774eb3658ff5676c47b1d738feaf8d25ca01 Mon Sep 17 00:00:00 2001
From: G30 <50341825+silentoplayz@users.noreply.github.com>
Date: Mon, 29 Jun 2026 02:53:20 -0400
Subject: [PATCH] fix(auth): enforce settings.interface permission on
 /user/settings/update endpoint (#25996)

---
 backend/open_webui/routers/users.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/backend/open_webui/routers/users.py b/backend/open_webui/routers/users.py
index 83eb25312a..c98eb2d6da 100644
--- a/backend/open_webui/routers/users.py
+++ b/backend/open_webui/routers/users.py
@@ -324,6 +324,14 @@ async def update_user_settings_by_session_user(
     user=Depends(get_verified_user),
     db: AsyncSession = Depends(get_async_session),
 ):
+    if user.role != 'admin' and not await has_permission(
+        user.id, 'settings.interface', request.app.state.config.USER_PERMISSIONS
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+        )
+
     updated_user_settings = form_data.model_dump()
     ui_settings = updated_user_settings.get('ui')
     if (