Lucene search
K

CVE-2026-44553 Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

๐Ÿ—“๏ธย 15 May 2026ย 19:54:09Reported byย GitHub_MTypeย 
cvelist
ย cvelist
๐Ÿ”—ย www.cve.org๐Ÿ‘ย 31ย Views

Before 0.9.0, admin changes do not clear the session pool, allowing revoked admins in sessions.

Related
Affected
Refs
ReporterTitlePublishedViews
Family
ATTACKERKB
CVE-2026-44553
15 May 202619:54
โ€“attackerkb
Circl
CVE-2026-44553
16 May 202612:01
โ€“circl
CNNVD
Open WebUI ไปฃ็ ้—ฎ้ข˜ๆผๆดž
15 May 202600:00
โ€“cnnvd
CVE
CVE-2026-44553
15 May 202619:54
โ€“cve
EUVD
EUVD-2026-30615
15 May 202619:54
โ€“euvd
Github Security Blog
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
8 May 202619:43
โ€“github
NVD
CVE-2026-44553
15 May 202620:16
โ€“nvd
OSV
GHSA-45M8-CPM2-3V65 Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
8 May 202619:43
โ€“osv
Positive Technologies
PT-2026-39270
8 May 202600:00
โ€“ptsecurity
RedhatCVE
CVE-2026-44553
19 May 202607:57
โ€“redhatcve
Rows per page
[
  {
    "vendor": "open-webui",
    "product": "open-webui",
    "versions": [
      {
        "version": "< 0.9.0",
        "status": "affected"
      }
    ]
  }
]

Data

Build on a solid foundation withย Vulners data

Weย provide theย essential building blocks forย cybersecurity solutions withย comprehensive, structured, andย constantly updated vulnerability andย exploits data

Api

Power your application withย Vulners API

The Vulners REST API offers reliable, high-performance access toย vulnerabilityย intelligence, withย 99.9%ย SLAย uptime andย CDN-backed data delivery forย seamlessย global access

App

Assess and manage vulnerabilities withย Vulnersย tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation