Executive brief
Open WebUI, a user interface for interacting with large language models, contains a flaw where unapproved or deactivated user accounts can still access interactive terminal sessions. This allows users who should be restricted to execute commands, browse files, and use terminal-based tools. The issue occurs because the terminal's communication channel does not properly verify the user's approval status, potentially leading to unauthorized access to the underlying server environment.
Technical details
An authorization bypass exists in the terminal WebSocket route of Open WebUI. While standard HTTP terminal routes use a dependency chain that enforces a 'verified_user' role check, the WebSocket route (/{server_id}/api/terminals/{session_id}) reimplements authentication inline and fails to verify the user's role status from the database. Consequently, accounts with a 'pending' status—either newly registered or recently deactivated—can establish interactive sessions if they possess a valid JWT and the terminal server is configured with broad access grants. This vulnerability stems from inconsistent authorization logic between HTTP and WebSocket code paths. The issue is resolved in version 0.11.0 by consolidating authentication into a shared helper.
Affected products
- Open WebUI open-webui >= 0.8.8, < 0.11.0
Timeline
- 2026-08-02: disclosed: Initial report/publication date
- 2026-08-04: advisory: GitHub Advisory published
- 2026-08-04: patched: Fix confirmed in version 0.11.0