Open WebUI EUVD-2026-97585

Exploitation requires an existing user account in Open WebUI that is linked to an external OAuth identity provider, plus a currently valid provider access token for that account. The flaw triggers specifically when the identity provider conveys role/authorization claims only in the ID token while omitting them from the userinfo response, and when an OAuth role policy is configured such that the user's current IdP role no longer qualifies for their prior Open WebUI role. The practical attacker is a user whose IdP role was downgraded or revoked but whose Open WebUI session role is not correspondingly demoted. Limiting factors: it does not work against unauthenticated attackers (a valid linked account and token are required), it has no effect if the IdP includes roles in the userinfo response, and it is confined to versions 0.11.1 through 0.11.3; impact is limited to retaining an already-held role, not arbitrary escalation.

This is a genuine but moderate-severity issue, not a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score are internally consistent with the description: exploitation is network-reachable and low-complexity, but requires PR:L - the attacker must already possess a valid, linked account and a working provider access token, so this is an authenticated privilege-retention flaw rather than an unauthenticated takeover. Impact is correctly scoped as VC:L/VI:L/VA:N with no scope change, reflecting that the attacker merely retains a previously-held role rather than escalating to arbitrary privileges. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or published exploit code; the absence of these signals is consistent with a narrow, condition-dependent bug. The practical risk is limited to environments where an identity provider delivers role claims only in the ID token and where a user's role has actually been downgraded or revoked at the IdP - a specific operational scenario. Overall: a legitimate authorization-logic defect worth patching, but lower real-world urgency than the network attack vector alone might suggest.

A former administrator (or other privileged user) whose role was downgraded or revoked at the identity provider still holds a linked Open WebUI account and a valid provider access token. They POST that token to /api/v1/auths/oauth/{provider}/token/exchange; because the server reads roles only from the userinfo response and keeps the existing role when no roles claim is present (ignoring the ID token), the returned session retains their old, higher privilege. No public exploit code was identified at time of analysis.