Improper Authorization in Open WebUI Affects Terminal Commands

CVE-2026-109289

What is CVE-2026-109289?

The Open WebUI application, specifically versions 0.8.8 through 0.11.4, is susceptible to an improper authorization flaw. This vulnerability allows deactivated users to continue executing terminal commands through an open terminal WebSocket session. The issue arises because access checks in the terminal proxy route only occur during the initial message, enabling these users to maintain control and execute commands without proper authorization, thereby posing significant risks to security and file integrity on the terminal server.

References