Executive brief
Open WebUI is a web-based interface for managing AI models. When an admin user is demoted through single sign-on (SSO), they retain full read and write access to all users' notes via active browser connections until those connections are explicitly closed or refreshed. This allows a demoted admin to continue accessing and modifying other users' private data despite being removed from the admin role in the identity provider.
Technical details
The vulnerability stems from insufficient session expiration in the Socket.IO handler layer. Open WebUI caches the user's role on the socket at connection time and uses this cached role to authorize access to collaborative notes. When a user is demoted via SSO role sync (either through `WEBUI_AUTH_TRUSTED_ROLE_HEADER` or OAuth role mapping), the role is updated in the database, but the cached role on open sockets is not invalidated. The admin user-management endpoints already perform session invalidation, but the two SSO role-sync paths (in `backend/open_webui/routers/auths.py` and `backend/open_webui/utils/oauth.py`) do not. As long as the Socket.IO connection remains open and active, the socket keep-alive rewrites the cached record without refreshing the stale role, granting full read and write access to any user's notes. The exposure ends immediately when the connection drops (sign-out, page reload, or network interruption). Fixed in 0.11.1 by publishing role-change events that tear down affected user sessions.
Affected products
- Open WebUI Open WebUI >= 0.9.0, < 0.11.1
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Version 0.11.1 released with fix commit ce3c175e260709f359d7e6cbb3132f0572098b95
- 2026-09-10: advisory