Executive brief
Open WebUI is a user interface for interacting with large language models that includes collaborative document editing features. A security flaw allows users who only have 'read-only' access to a document to bypass restrictions and modify or delete content in real-time. While these unauthorized changes are initially temporary, they become permanent if any authorized user saves the document, potentially leading to data corruption or the injection of misleading information.
Technical details
An authorization bypass exists in the Socket.IO collaborative document editing handler within `backend/open_webui/socket/main.py`. The `ydoc:document:update` event handler verifies that a user is a member of a document's Socket.IO room but fails to verify if the user possesses 'write' permissions. Because users with 'read' access are permitted to join these rooms, they can emit update events that modify the in-memory Yjs document state. While the server-side save handler correctly enforces write permissions for database persistence, any modifications made by the read-only attacker are broadcast to all participants and will be persisted if an authorized user (or an autosave function) triggers a save operation. This issue is patched in version 0.9.0.
Affected products
- open-webui open-webui <= 0.8.12
Timeline
- 2026-05-05: disclosed: Initial report by Classic298
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-08: patched: Version 0.9.0 released
- 2026-05-15: kev added: NVD publication date