Open WebUI CVE-2026-59216

Exploitation requires an authenticated Open WebUI account (PR:L) on a multi-user instance where the code interpreter (execute:python) and/or tool execution (execute:tool) features are enabled. The attacker must obtain a victim's socket/session ID, which is exposed through the ydoc:document:join collaborative-document flow, so the victim must have a live, connected session (the UI:R/interaction and 'Automatable: no' limiting factors). Limits: single-user deployments are not meaningfully at risk, the target session must be currently connected, and the attacker needs valid credentials - this is not unauthenticated or default-config remote exploitation.

Signals are moderately aligned toward a real but not spray-and-pray threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, 9.0) reflects network reach, low complexity, an authenticated but low-privileged attacker, required user interaction, and a scope change with total confidentiality/integrity/availability impact on the victim session. SSVC agrees on impact (Technical Impact: total) and records exploitation as 'poc' with Automatable: no - consistent with the fact that the attacker must first obtain another user's socket ID and rely on the victim being active in a shared document, so it does not lend itself to untargeted automation. EPSS is low (0.28%, 19th percentile) and the CVE is not in CISA KEV, so there is no evidence of active exploitation; the low EPSS is congruent with a POC-only, interaction-and-authentication-gated bug rather than a contradiction. Net: a genuinely high-severity, patch-now issue for any multi-user Open WebUI deployment, but the practical barrier (need an account, need a victim's live session/socket) makes it targeted rather than wormable. No major data conflicts were identified; UI:R and S:C are supported by the description's requirement that code runs in a second user's session.

A low-privileged but authenticated Open WebUI user joins a shared collaborative document to learn a victim's active socket/session ID via ydoc:document:join, then sends an execute:python (or execute:tool) Socket.IO event naming that foreign session_id. The code interpreter runs the attacker's Python within the victim's session context, yielding cross-user code execution and access to the victim's data and actions. A proof-of-concept is indicated in the SSVC intelligence, and the low attack complexity makes the technique straightforward once a target session is active.