GHSA-WJWR-XFP9-R66P Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

CVE-2026-87014

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-87014

Open WebUI (self-hosted AI platform) versions 0.9.0 through 0.11.1 contain a privilege-escalation issue in its role synchronization logic. The files backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user rec...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

PT-2026-89161

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An issue exists where role synchronization fails to invalidate cached user records during a privilege demotion. When an administrator is demoted via a trusted role header or OAuth role...

The vulnerability of the SOGo software server for collaborative work lies in the lack of protective measures for SQL query structures, allowing attackers to trigger service failures.

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

The vulnerability of the SOGo software server for collaborative work lies in the lack of protective measures for SQL query structures, allowing attackers to trigger service failures.

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

CVE-2026-58416

A flaw was found in Gitea. The Fork-PR Actions task, which handles pull requests from forked repositories, can be exploited to read data from a third private repository. This occurs due to a missing guard that should prevent unauthorized access via the collaborative-owner branch. A remote attacke...

CVE-2026-58416

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58416: Improper Handling of Insufficient Permissions or Privileges

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

The vulnerability of the LiveTableResults component of the XWiki Platform, a platform for creating collaborative web applications. The XWiki Platform allows attackers to expose protected information.

The vulnerability of the LiveTableResults component in the XWiki platform, which is used for creating collaborative web applications, stems from deficiencies in restricting access to personal information. Exploiting this vulnerability could allow a malicious actor to disclose protected informatio...

PYSEC-2026-3599 Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Summary The Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact wit...

The vulnerability of the page display mechanism of the software platform based on Git, which is used for collaborative code development in GitLab CE/EE, allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the page display mechanism for software-based programming platforms based on Git, which is used for collaborative code development in GitLab CE/EE, is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perfor...

CVE-2026-64512

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI Collaborative Processor Performance Control CPPC module. A field misuse related to register access width can lead to a "shift-out-of-bounds" error. This undefined behavior could potentially cause system...

UBUNTU-CVE-2026-64512

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppress UBSAN warning caused by field misuse The definition of reg-accesswidth changes depending on the reg-spaceid type. Type ACPIADRSPACEPLATFORMCOMM uses accesswidth to indicate the PCC region, which can result in...

Missing Authentication for Critical Function

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authentication for Critical Function via unauthenticated access to the ydoc:awareness:update and ydoc:document:leave event handlers. An attacker can disrupt collaborative editing sessions, impersonate...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the GetActionsUserRepoPermission function. An attacker can gain unauthorized read access to the contents of a private repository by exploiting a missing permission check when a collaborative owner is configur...