CVE-2026-87014

MediumCVSS 6.5/10Last modified Sep 15, 2026

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by backend/open_webui/socket/main.py. An administrator demoted through a trusted role header or OAuth role mapping could keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closed. This issue is fixed in version 0.11.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2026
Last modified: Sep 15, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-870156.8Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/too CVE-2026-870168.1Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and ge CVE-2026-870174.3Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search CVE-2026-870187.5undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client p CVE-2026-870194.3Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87026.4The GBI To Print plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the 'div' attribute of the 'gbitoprint CVE-2026-870208.1An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes a CVE-2026-870217.2Tanium addressed an unauthorized code execution vulnerability in Comply.CVE-2026-870227.5Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-defla CVE-2026-870238.5Tanium addressed a path traversal vulnerability in Comply.CVE-2026-870247.2Tanium addressed a SQL injection vulnerability in Asset.CVE-2026-870255.4Tanium addressed an improper access controls vulnerability in Comply.