DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-87014: CVE-2026-87014: Session Desynchronization and Privilege Persistence in Open WebUI

#security #cve #cybersecurity

CVE-2026-87014: Session Desynchronization and Privilege Persistence in Open WebUI

Vulnerability ID: CVE-2026-87014
CVSS Score: 6.5
Published: 2026-09-10

Open WebUI from version 0.9.0 to 0.11.1 is vulnerable to a state desynchronization and privilege persistence flaw. When an administrator is demoted to a standard user via Single Sign-On (SSO) role synchronization, the local database is updated, but their active Socket.IO connection is not invalidated. Because the WebSocket handlers authorize operations using the cached role in the socket context, the demoted user retains administrative read and write access to all collaborative notes.

TL;DR

A session desynchronization flaw in Open WebUI lets demoted administrators retain administrative read/write access to all users' collaborative notes via active, uninvalidated Socket.IO connections.

Technical Details

  • CWE ID: CWE-613 / CWE-863
  • Attack Vector: Network
  • CVSS Score: 6.5 (Medium)
  • EPSS Score: 0.00278 (0.28%)
  • Impact: High (Confidentiality & Integrity)
  • Exploit Status: No public PoC
  • KEV Status: Not listed

Affected Systems

  • Open WebUI
  • Open WebUI: >= 0.9.0, < 0.11.1 (Fixed in: 0.11.1)

Code Analysis

Commit: ce3c175

Fix role synchronization: Admin demoted through SSO role sync keeps read and write access to all users' notes

Mitigation Strategies

  • Upgrade to Open WebUI version 0.11.1 or later to leverage the new event-driven session invalidation mechanism.
  • Perform a complete application service or container restart following administrative or automated SSO role demotions to clear stateful connections.
  • Monitor active Socket.IO connection actions for mismatches between database roles and cached connection-time roles.

Remediation Steps:

  1. Verify the currently deployed version of Open WebUI by checking the administration panel settings or running 'pip show open-webui'.
  2. If the version is between 0.9.0 and 0.11.0 (inclusive), schedule a maintenance window.
  3. Execute 'pip install --upgrade open-webui' or update your container deployment configuration to pull tag 'v0.11.1' or later.
  4. Restart the application service to clear memory-cached socket contexts.

References

Read the full report for CVE-2026-87014 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)