CVE-2026-87014: Open WebUI Admin Role Sync Vulnerability Allows Unauthorized Access to User Notes
Summary
CVE-2026-87014: Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes. Affects open-webui versions >= 0.9.0, < 0.11.1. Fixed in 0.11.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is an open-source web application designed for collaborative note-taking and user management. It leverages Socket.IO for real-time communication and supports Single Sign-On (SSO) for user authentication. The application is widely used in environments where multiple users need to access and edit notes collaboratively. However, a vulnerability exists in the role synchronization process that can lead to unauthorized access to sensitive user data.
Vulnerability Detail
The vulnerability arises when an admin user is demoted through an SSO role sync while maintaining an active Socket.IO connection. The application caches the user's role at the time of connection, which means that even after demotion, the user retains admin-level access to all users' notes until the socket connection is terminated. This flaw allows a demoted user to read and write other users' private notes, posing a significant security risk. The issue is rooted in the way the application handles role changes and session invalidation, particularly in the SSO paths, which do not refresh the cached role on the socket.
How To Fix
Latest published version: 0.12.3 as of 22 Oct 2026
pip install --upgrade "open-webui==0.12.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.11.1
This is the first release that contains the fix.
pip install --upgrade "open-webui==0.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any role changes are performed through the admin panel, which correctly invalidates the user's socket connections. Additionally, consider implementing a policy to require users to log out and log back in after any role changes.
Conclusion
The CVE-2026-87014 vulnerability in Open WebUI poses a significant risk by allowing demoted admin users to retain unauthorized access to user notes. It is crucial to upgrade to version 0.11.1 or later to mitigate this issue. Implementing proper role management and session invalidation practices is essential for maintaining data security.
See every vulnerability recorded for open-webui →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Without requiring access to the code or installation, you can check your application using the Vulert playground at Vulert Scanner.
If a user is demoted while connected, they retain admin-level access to all users' notes until the socket connection is closed, allowing them to read and edit notes they should no longer have access to.
Yes, the vulnerability specifically affects deployments using SSO role-sync methods, such as trusted-header authentication or OAuth role mapping.
The consequences include unauthorized access to sensitive user notes, which can lead to data breaches and loss of user trust.
References
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
