CVE-2026-87014

🗓️ 09 Sep 2026 21:01:39Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 26 Views🌐 WEB

Open WebUI 0.9.0-0.11.1: SSO-demoted admin retains cached Socket.IO access to all user notes.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerabilities in the backend files open_webui/routers/auths.py, backend/open_webui/utils/oauth.py, and backend/open_webui/socket/main.py of the Open WebUI artificial intelligence-based web interface allow a attacker to compromise the confidentiality and integrity of the protected information.	18 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-87014	11 Sep 202600:35	–	circl
Cvelist	CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes	9 Sep 202621:01	–	cvelist
EUVD	EUVD-2026-75173	10 Sep 202622:41	–	euvd
Github Security Blog	Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes	10 Sep 202622:41	–	github
NVD	CVE-2026-87014	9 Sep 202621:17	–	nvd
OSV	GHSA-WJWR-XFP9-R66P Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes	10 Sep 202622:41	–	osv
Positive Technologies	PT-2026-89161	9 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-87014: Insufficient Session Expiration	9 Sep 202600:00	–	rapid7
Snyk	Incorrect Authorization	10 Sep 202622:41	–	snyk

NVD

Vulners

Node

openwebui open_webuiRange0.9.0–0.11.1

[
  {
    "vendor": "open-webui",
    "product": "open-webui",
    "versions": [
      {
        "version": ">= 0.9.0, < 0.11.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/open-webui/open-webui/commit/ce3c175e260709f359d7e6cbb3132f0572098b95
github	www.github.com/open-webui/open-webui/security/advisories/GHSA-wjwr-xfp9-r66p
github	www.github.com/open-webui/open-webui/releases/tag/v0.11.1

Parameter	Position	Path	Description	CWE
trusted role header	path	backend/open_webui/routers/auths.py	Role synchronization in authentication routers may allow administrator demotion via trusted role header leading to continued access for open sessions.	CWE-613, CWE-863
role synchronization	path	backend/open_webui/routers/auths.py	Role synchronization in authentication routers may allow administrator demotion via trusted role header leading to continued access for open sessions.	CWE-613, CWE-863
OAuth role mapping	path	backend/open_webui/utils/oauth.py	OAuth role mapping pathway could demote an administrator without invalidating the user cache.	CWE-613, CWE-863
role update	path	backend/open_webui/utils/oauth.py	OAuth role mapping pathway could demote an administrator without invalidating the user cache.	CWE-613, CWE-863
Socket.IO session cache	path	backend/open_webui/socket/main.py	An administrator with updated role could keep an open Socket.IO connection reading/editing user notes due to stale cache.	CWE-613, CWE-863
open connection	path	backend/open_webui/socket/main.py	An administrator with updated role could keep an open Socket.IO connection reading/editing user notes due to stale cache.	CWE-613, CWE-863
user cache invalidation	path	backend/open_webui/socket/main.py	An administrator with updated role could keep an open Socket.IO connection reading/editing user notes due to stale cache.	CWE-613, CWE-863

15 Sep 2026 15:56Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.16.5

EPSS0.00513

SSVC