CVE-2026-87014 Overview
Open WebUI is a self-hosted artificial intelligence (AI) platform used to interact with local and remote language models. A role synchronization flaw in versions 0.9.0 through 0.11.0 allows a demoted administrator to retain elevated privileges over an active Socket.IO connection. The backend updates the user's database role but does not invalidate the cached session held by backend/open_webui/socket/main.py. As a result, an attacker whose admin role was revoked through a trusted role header or OAuth mapping can continue reading and modifying every user's collaborative notes until the socket disconnects. The issue is tracked as [CWE-613] Insufficient Session Expiration and is fixed in version 0.11.1.
Critical Impact
A demoted administrator retains full read and write access to all users' collaborative notes for the lifetime of an already-open Socket.IO session.
Affected Products
- Open WebUI version 0.9.0 through 0.11.0
- Deployments using trusted role header authentication (WEBUI_AUTH_TRUSTED_ROLE_HEADER)
- Deployments using OAuth role mapping via backend/open_webui/utils/oauth.py
Discovery Timeline
- 2026-09-09 - CVE CVE-2026-87014 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87014
Vulnerability Analysis
Open WebUI maintains authenticated user state in two places. The database stores the persistent role, while backend/open_webui/socket/main.py caches the authenticated user record for the lifetime of each Socket.IO connection. When an administrator is demoted, the role synchronization logic in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updates the database record but never signals the socket layer to disconnect or refresh the cached user object. The open WebSocket continues to service events under the previous admin role, granting access to collaborative notes belonging to other users.
Root Cause
The root cause is insufficient session expiration [CWE-613]. Authorization decisions on the socket channel rely on a stale, in-memory user object. Role changes triggered externally by a trusted header or OAuth identity provider are not propagated as an invalidation event, leaving privilege state inconsistent between the persistence layer and the active session cache.
Attack Vector
An authenticated attacker with a currently established Socket.IO session is required. The attacker's role is downgraded from admin to user or pending through the trusted header path or OAuth role mapping. Because the socket session is not torn down, the attacker continues issuing collaborative notes read and edit events until they close the connection or the server restarts.
trusted_role = request.headers.get(WEBUI_AUTH_TRUSTED_ROLE_HEADER, '').lower().strip()
if trusted_role in {'admin', 'user', 'pending'}:
if user.role != trusted_role:
- await Users.update_user_role_by_id(user.id, trusted_role, db=db)
+ updated_user = await Users.update_user_role_by_id(user.id, trusted_role, db=db)
+ if updated_user:
+ user = updated_user
+ await publish_event(
+ request,
+ EVENTS.USER_ROLE_UPDATED,
+ actor=updated_user,
+ subject_id=updated_user.id,
+ source='trusted_header',
+ data={'role': updated_user.role},
+ )
elif trusted_role:
log.warning(f'Ignoring invalid trusted role header value: {trusted_role}')
Source: GitHub Commit ce3c175
The patch adds a USER_ROLE_UPDATED event that a new SocketSessionEventSink consumes to disconnect the affected user's active sockets.
Detection Methods for CVE-2026-87014
Indicators of Compromise
- Socket.IO events performing administrative actions from a user whose current database role is user or pending.
- Access or modification of collaborative notes owned by other users shortly after a role change from admin.
- Long-lived Socket.IO connections that survive an OAuth re-authentication or trusted header role transition.
Detection Strategies
- Correlate audit logs of role demotions with subsequent Socket.IO event activity attributed to the demoted account.
- Inspect application logs for WEBUI_AUTH_TRUSTED_ROLE_HEADER value changes without a corresponding disconnect entry from backend/open_webui/socket/main.py.
- Alert on write operations against collaborative notes where the acting user is not the note owner and no longer holds an admin role.
Monitoring Recommendations
- Enable verbose logging on the Open WebUI authentication and socket modules to capture role transitions and connection lifecycle events.
- Forward Open WebUI application logs to a centralized SIEM or data lake for retention and correlation.
- Track the count of concurrent Socket.IO sessions per user and flag sessions that persist across identity provider role changes.
How to Mitigate CVE-2026-87014
Immediate Actions Required
- Upgrade all Open WebUI deployments to version 0.11.1 or later.
- Restart the Open WebUI service after upgrade to terminate any stale Socket.IO connections.
- Review recent administrator demotions and audit collaborative notes activity performed by those accounts.
Patch Information
The fix is available in Open WebUI v0.11.1. The change introduces a SocketSessionEventSink that listens for USER_DELETED and USER_ROLE_UPDATED events and calls disconnect_user_sessions to invalidate active sockets. Details are documented in GHSA-wjwr-xfp9-r66p.
Workarounds
- If patching cannot occur immediately, restart the Open WebUI backend after any administrator role change to force socket reconnection.
- Temporarily disable trusted role header processing by unsetting WEBUI_AUTH_TRUSTED_ROLE_HEADER until the upgrade is applied.
- Restrict role mapping changes in the upstream OAuth identity provider to windows when users are known to be offline.
# Verify the running Open WebUI version and upgrade via container image
docker inspect open-webui --format '{{.Config.Image}}'
docker pull ghcr.io/open-webui/open-webui:0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui ghcr.io/open-webui/open-webui:0.11.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
