Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

SummaryA user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

PYSEC-2026-4127 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

PT-2026-105876

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

EUVD-2026-75173

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes...

GHSA-WJWR-XFP9-R66P Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the caching of user roles on active Socket.IO connections during SSO-driven role changes. An attacker can retain unauthorized read and write access to other users' private note...

CVE-2026-87014

Open WebUI (self-hosted AI platform) versions 0.9.0 through 0.11.1 contain a privilege-escalation issue in its role synchronization logic. The files backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user rec...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

EUVD-2026-58680

In Akaunting versions sync call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by...

CVE-2026-16772 CVE-2026-16772

In Akaunting versions sync call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by...

CVE-2026-16772

In Akaunting versions sync call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by...

CVE-2026-16772

In Akaunting versions sync() call on user-supplied role assignments without verifying if the caller is authorized to manage roles. To exploit this, an attacker only needs the default update-auth-profile permission to access the self-update path. Notably, API endpoints are correctly permission-gat...

PT-2026-72040

Name of the Vulnerable Software and Affected Versions Akaunting versions prior to 3.1.22 Description Low-privileged authenticated users can elevate their privileges to full administrator by modifying their own account. This occurs due to a flaw in the UpdateUser job, which uses an unconditional...