EUVD-2026-75173
GHSA-wjwr-xfp9-r66p
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
PR:H because only an existing administrator can exploit the stale session; C:H and I:H reflect full read/write access to all users' collaborative notes; A:N as availability is unaffected.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by backend/open_webui/socket/main.py. An administrator demoted through a trusted role header or OAuth role mapping could keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closed. This issue is fixed in version 0.11.1.
AnalysisAI
Insufficient session expiration in Open WebUI 0.9.0-0.11.0 allows a demoted administrator to retain full read and write access to all users' collaborative notes by keeping an existing Socket.IO connection open after their role is revoked. The flaw exists because role updates applied through trusted role headers, OAuth role mapping, or SCIM provisioning write the new role to the database but do not invalidate the stale user record cached in the Socket.IO SESSION_POOL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the attacker currently holds Open WebUI administrator role (PR:H); (2) the attacker has an active, open Socket.IO connection to the affected Open WebUI instance at the moment their role is revoked; (3) the demotion is triggered via a trusted role header during sign-in (auths.py), OAuth role mapping (oauth.py), or SCIM PATCH/PUT provisioning - these are the code paths that, prior to the fix, updated the database role without emitting USER_ROLE_UPDATED events to invalidate socket sessions; and (4) the attacker does not voluntarily close the browser or client. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N appropriately reflects the high-privilege prerequisite: only a user who holds or recently held Open WebUI administrator status and has an active Socket.IO connection at demotion time can exploit this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Open WebUI version 0.11.1 or later, which resolves the issue by introducing a SocketSessionEventSink that automatically disconnects all Socket.IO sessions for a user whenever a USER_ROLE_UPDATED or USER_DELETED event fires, ensuring SESSION_POOL entries are flushed on every privilege change. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Open Webui
View allA vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Sit
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. Rated high severity (CV
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handlin
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF)
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today