Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by backend/open_webui/socket/main.py. An administrator demoted through a trusted role header or OAuth role mapping could keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closed. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T21:17:06.327Z",
  "pubdate": "2026-09-09T21:17:06.327Z",
  "executiveSummary": "A session persistence vulnerability exists in Open WebUI versions 0.9.0 through 0.11.1, stemming from inadequate invalidation of Socket.IO user state during role synchronization.\nThe vulnerability allows an administrator whose privileges have been demoted via backend role mapping—such as trusted headers or OAuth providers—to maintain elevated access if they possess an active Socket.IO connection.\nWhile the user's role is correctly updated within the persistent database, the real-time application state cached by the WebSocket handler remains stale, granting the user unauthorized administrative persistence.\nThis flaw facilitates a broken access control scenario where demoted users retain full read/write capabilities over sensitive collaborative notes until the existing socket session is explicitly terminated.\nThe risk is significant as it bypasses central authentication logic, allowing a malicious or compromised actor to maintain persistent administrative control despite successful identity provider or middleware-level demotion.",
  "technicalDetails": "The root cause of this vulnerability lies in a lack of synchronization between the authentication database and the real-time state management handled by the Socket.IO event bus. In Open WebUI, user roles are governed by backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py, which effectively update the user's role in the database upon authentication or synchronization events.\nHowever, the application architecture utilizes a separate caching mechanism within backend/open_webui/socket/main.py to maintain active user states for persistent Socket.IO connections. When a role change is committed to the database, the system fails to broadcast an invalidation or session-refresh signal to the WebSocket manager.\nThe attack flow proceeds as follows: First, an attacker establishes a legitimate authenticated session with administrative privileges, resulting in an active Socket.IO connection that is cached by the server. Second, an external security policy or identity provider update (via OAuth mapping or a trusted header) triggers a privilege demotion for that user in the backend database. Third, because the WebSocket handler in backend/open_webui/socket/main.py does not query the database for current role verification during ongoing communication, the server continues to treat the existing socket session as 'admin' based on the stale cached state.\nThis results in a state of 'authorization bypass via session persistence.' The attacker, now functionally a standard user according to the database, retains the ability to perform administrative actions, such as accessing or modifying collaborative notes belonging to any user on the platform. The impact is restricted to the lifetime of the TCP connection; however, if the client implements aggressive keep-alive mechanisms or if the server does not enforce periodic re-authentication of socket events, the unauthorized access can persist indefinitely. The vulnerability persists across all deployments of versions 0.9.0 through 0.11.1, requiring an upgrade to 0.11.1 to implement the necessary state-invalidation logic."
}