Executive brief
Open WebUI is an interface for interacting with large language models. A security flaw allows users who have had their administrator privileges revoked to continue performing administrative actions, such as reading or modifying other users' private notes, as long as they keep their current browser session open. This means that even after a user is demoted or deleted by a legitimate administrator, they can still access and change sensitive data until they manually log out or close their connection.
Technical details
The vulnerability exists because Open WebUI snapshots a user's role into an in-memory Socket.IO SESSION_POOL during the initial connection but fails to refresh this role during subsequent heartbeat events or invalidate the session when a user's role is updated or deleted in the database. Collaborative document handlers (Yjs) perform authorization checks against this cached, stale role rather than the database. An attacker who established a Socket.IO connection while holding an admin role can maintain that role indefinitely by keeping the connection alive via heartbeats, bypassing authorization checks in 'ydoc:document:join' and 'document_save_handler'. This allows the attacker to read and write to any user's notes despite being demoted or deleted. The issue is fixed in version 0.9.0.
Affected products
- Open WebUI open-webui <= 0.8.12
Timeline
- 2026-05-05: disclosed: Initial report to vendor
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-15: patched: NVD publication and patch availability confirmed