CVE-2026-87014
CVE-2026-87014 · Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by backend/open_webui/socket/main.py. An administrator demoted through a trusted role header or OAuth role mapping could keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closed. This issue is fixed in version 0.11.1.
CVSS 6.5 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
open-webui
- Versions
- >= 0.9.0, < 0.11.1: Affected
No fix published
open-webui PyPI
- Versions
- 0.10.0
- 0.10.1
- 0.10.2
- 0.11.0
- 0.9.0
- 0.9.1
- 0.9.2
- 0.9.3
- 0.9.4
- 0.9.5
- 0.9.6
- Affected ranges
- ECOSYSTEM: ≥ 0.9.0, < 0.11.1
Update to 0.11.1