From 0758d63d73d23483a8ad65374b8b26c6ad7b5f8d Mon Sep 17 00:00:00 2001 From: theshivam7 Date: Tue, 7 Apr 2026 23:57:39 +0530 Subject: [PATCH] fix: reject empty update payload with 400 --- backend/open_webui/routers/users.py | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/backend/open_webui/routers/users.py b/backend/open_webui/routers/users.py index 1d47b31c98..b9111785b1 100644 --- a/backend/open_webui/routers/users.py +++ b/backend/open_webui/routers/users.py @@ -607,9 +607,6 @@ async def update_user_by_id( hashed = get_password_hash(form_data.password) Auths.update_user_password_by_id(user_id, hashed, db=db) - if form_data.email is not None: - Auths.update_email_by_id(user_id, form_data.email.lower(), db=db) - update_data = { k: v for k, v in { @@ -620,6 +617,16 @@ async def update_user_by_id( }.items() if v is not None } + + if not update_data and not form_data.password: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail='At least one field must be provided to update.', + ) + + if form_data.email is not None: + Auths.update_email_by_id(user_id, form_data.email.lower(), db=db) + updated_user = Users.update_user_by_id( user_id, update_data,