13949 matches found
GHSA-WJWR-XFP9-R66P Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...
CVE-2026-82791
creationtimestamp| type| source ---|---|--- 2026-09-10 08:46:32+00:00| seen| https://jvn.jp/en/vu/JVNVU90314828...
CVE-2026-82793
creationtimestamp| type| source ---|---|--- 2026-09-10 08:46:28+00:00| seen| https://jvn.jp/en/vu/JVNVU90314828...
CVE-2026-82777
creationtimestamp| type| source ---|---|--- 2026-09-10 08:46:01+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...
CVE-2026-82788
creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:58+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...
CVE-2026-82776
creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:56+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...
CVE-2026-82789
creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:43+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...
CVE-2026-82762
creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:39+00:00| seen| https://jvn.jp/en/vu/JVNVU99009004...
CVE-2026-82771
creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:27+00:00| seen| https://jvn.jp/en/vu/JVNVU99009004...
CVE-2026-82764
creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:18+00:00| seen| https://jvn.jp/en/vu/JVNVU99009004 2026-09-10 08:46:17+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518 2026-09-10 08:46:34+00:00| seen| https://jvn.jp/en/vu/JVNVU90314828...
CVE-2026-82796
creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:14+00:00| seen| https://jvn.jp/en/vu/JVNVU97753461...
CVE-2026-82794
creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:10+00:00| seen| https://jvn.jp/en/vu/JVNVU97753461...
CVE-2026-87014
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...
CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...
CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...
CVE-2026-87014
Open WebUI (self-hosted AI platform) versions 0.9.0 through 0.11.1 contain a privilege-escalation issue in its role synchronization logic. The files backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user rec...
CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...
CVE-2026-21107
Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory...
CVE-2026-21107
CVE-2026-21107 is an out-of-bounds write vulnerability in Samsung Notes prior to version 4.4.45.5 , allowing a local attacker with low privileges to write to out-of-bounds memory. The CVSS 4.0 base score is 6.9 (MEDIUM) , with a local attack vector, low complexity, and no user interaction require...