CVE-2026-44564: Open WebUI Auth Bypass Vulnerability

CVE-2026-44564 Overview

CVE-2026-44564 is a missing authorization vulnerability [CWE-863] in Open WebUI, a self-hosted artificial intelligence platform that operates entirely offline. The flaw resides in the collaborative document subsystem, specifically the ydoc:document:update Socket.IO event handler. The handler verifies room membership but fails to verify write permission, allowing read-only collaborators to mutate shared Yjs document state. Modifications are broadcast in real time to every connected collaborator. The issue affects all releases prior to 0.9.0 and is fixed in version 0.9.0.

Critical Impact

Authenticated users with read-only access can modify collaborative documents and propagate unauthorized changes to all other participants in real time.

Affected Products

• Open WebUI versions prior to 0.9.0
• Self-hosted Open WebUI deployments using collaborative document features
• Multi-tenant Open WebUI instances with read-only document sharing

Discovery Timeline

• 2026-05-15 - CVE-2026-44564 published to the National Vulnerability Database
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-44564

Vulnerability Analysis

Open WebUI implements real-time collaborative editing through Socket.IO rooms backed by Yjs, a CRDT framework for shared data structures. Each document maps to a Socket.IO room. Clients join the room through the ydoc:document:join event and emit updates through ydoc:document:update.

The ydoc:document:update handler at line 678 of the affected source enforces only a single authorization check. It validates that the sender is a member of the document's Socket.IO room. It does not consult the document's access control list to confirm the sender holds write permission. Any user already joined to the room can therefore apply Yjs updates to the in-memory document.

The broadcast logic compounds the impact. Updates accepted by the server are relayed to all other room members, who merge the changes into their local Yjs state. This results in unauthorized integrity loss across every active collaborator session.

Root Cause

The root cause is a broken access control pattern in which the server conflates room membership with write authorization. The ydoc:document:join handler at line 520 requires only read permission to join the room. Once joined, the user inherits the implicit privileges of any other room participant because no per-event authorization check exists on update operations.

Attack Vector

An attacker requires a valid Open WebUI account with read-only access to a target document. The attacker connects over the network, authenticates, and issues a ydoc:document:join event for the document. After the server accepts the join, the attacker emits a crafted ydoc:document:update event containing arbitrary Yjs operations. The server applies and rebroadcasts the update without further checks. No user interaction by other collaborators is required for the modification to propagate.

The vulnerability is described in prose because no public proof-of-concept code has been released. Technical specifics are documented in the GitHub Security Advisory GHSA-vrfh-rj4q-rmhr.

Detection Methods for CVE-2026-44564

Indicators of Compromise

• Socket.IO ydoc:document:update events originating from session identifiers mapped to read-only users
• Unexpected revisions to shared documents with audit trails showing modifications by non-writer accounts
• Sudden divergence between persisted document state and the last authorized writer's session history

Detection Strategies

• Correlate Socket.IO event logs with the document permission model to flag ydoc:document:update emissions from principals lacking the writer role
• Enable verbose Open WebUI application logging and ship events to a centralized SIEM for permission-versus-action analysis
• Establish a baseline of expected editor identities per document and alert on deviations

Monitoring Recommendations

• Monitor reverse proxy and WebSocket gateway logs for high-frequency ydoc:document:update traffic from individual sessions
• Audit document change history weekly and compare modifier identities against the documented permission grants
• Track authentication events alongside collaborative editing events to detect abuse by compromised low-privilege accounts

How to Mitigate CVE-2026-44564

Immediate Actions Required

• Upgrade Open WebUI to version 0.9.0 or later, which adds the missing write-permission check on the ydoc:document:update handler
• Inventory existing document permission grants and revoke read-only access where it is not strictly required
• Review document revision history for unauthorized modifications made prior to patching

Patch Information

The vulnerability is fixed in Open WebUI 0.9.0. The patched handler verifies that the sender holds write permission before applying or broadcasting Yjs updates. Refer to the Open WebUI Security Advisory GHSA-vrfh-rj4q-rmhr for release details.

Workarounds

• Disable collaborative document sharing until the upgrade to 0.9.0 is complete
• Restrict document sharing to users who require write access and remove read-only grants where feasible
• Place Open WebUI behind a reverse proxy that authenticates and rate-limits WebSocket traffic to reduce abuse exposure

# Upgrade Open WebUI to the patched release
docker pull ghcr.io/open-webui/open-webui:0.9.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.9.0