CVE-2026-87014: Open WebUI session privilege escalation through SSO role sync

CVE-2026-87014 · Severity: medium · CVSS 6.5 · Published 2026-09-09

Open WebUI is a web-based interface for managing AI models. When an admin user is demoted through single sign-on (SSO), they retain full read and write access to all users' notes via active browser connections until those connections are explicitly closed or refreshed. This allows a demoted admin to continue accessing and modifying other users' private data despite being removed from the admin role in the identity provider.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-87014 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87014 being exploited in the wild.
How severe is CVE-2026-87014?
Medium severity, with a CVSS score of 6.5, published 9 September 2026.
Which products and versions are affected?
open-webui (PyPI) >= 0.9.0, < 0.11.1, ECOSYSTEM:introduced=0.9.0,fixed=0.11.1.
Is there a fix for CVE-2026-87014?
Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87014 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-87014?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.11.1 or later
    pip install "open-webui>=0.11.1"

Technical details

The vulnerability stems from insufficient session expiration in the Socket.IO handler layer. Open WebUI caches the user's role on the socket at connection time and uses this cached role to authorize access to collaborative notes. When a user is demoted via SSO role sync (either through `WEBUI_AUTH_TRUSTED_ROLE_HEADER` or OAuth role mapping), the role is updated in the database, but the cached role on open sockets is not invalidated. The admin user-management endpoints already perform session invalidation, but the two SSO role-sync paths (in `backend/open_webui/routers/auths.py` and `backend/open_webui/utils/oauth.py`) do not. As long as the Socket.IO connection remains open and active, the socket keep-alive rewrites the cached record without refreshing the stale role, granting full read and write access to any user's notes. The exposure ends immediately when the connection drops (sign-out, page reload, or network interruption). Fixed in 0.11.1 by publishing role-change events that tear down affected user sessions.

Affected products

  • Open WebUI Open WebUI >= 0.9.0, < 0.11.1

Identifiers

  • CVE-2026-87014
  • GHSA-wjwr-xfp9-r66p
  • PYSEC-2026-4127

Timeline

  • 2026-09-04: disclosed
  • 2026-09-04: patched: Version 0.11.1 released with fix commit ce3c175e260709f359d7e6cbb3132f0572098b95
  • 2026-09-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.