Open WebUI CVE-2026-59224

Exploitation requires an authenticated Open WebUI account (CVSS PR:L) and an instance that exposes the terminal feature (the ws_terminal WebSocket endpoint in terminals.py). The concrete prerequisite is the ability to supply an attacker-controlled session_id that reaches the unencoded URL-building path, or to send a forged X-User-Id header through the HTTP proxy path - both present by default in vulnerable builds prior to 0.10.0. Limiting factors that reduce real-world risk: the attacker needs a pre-existing account rather than anonymous access, the assigned vector indicates high attack complexity (AC:H) and user interaction (UI:R), and the identity-spoof only has value where multiple distinct user identities coexist - a single-user self-hosted instance has no other identity to impersonate.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) describes a high-impact but non-trivial attack: network-reachable, but requiring an existing low-privileged account (PR:L), high attack complexity (AC:H) to craft the injection and win the identity resolution, and user interaction (UI:R). The scope change (S:C) reflects crossing from the attacker's authority into another user's identity domain, and C:H/I:H/A:H reflect full compromise of the victim's terminal session. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is identified - signals point to a credible but not yet weaponized issue. The AC:H and UI:R conditions materially lower real-world exploitability versus a drive-by unauthenticated bug, so this is a genuine priority for multi-tenant/shared Open WebUI deployments but lower urgency for single-user self-hosted instances. One tension worth verifying: the description frames a direct query-injection/identity-spoof that does not obviously require victim interaction, yet the assigned vector includes UI:R - treat the UI:R qualifier as vendor-assigned rather than confirmed from the technical description.

An attacker holding a valid low-privileged Open WebUI account opens a terminal session and supplies a crafted session_id containing extra 'user_id=' query material (or forges the X-User-Id header on the HTTP proxy path). Because the backend concatenates the unencoded value into the upstream WebSocket URL and trusts the resulting user_id, the terminal backend resolves the attacker to a targeted victim's identity, granting that user's terminal session context. No public proof-of-concept was identified, and the high attack complexity means the attacker must correctly shape the injection to win identity resolution.