Role Synchronization Vulnerability in Open WebUI by Open WebUI

CVE-2026-87014

What is CVE-2026-87014?

Open WebUI, a user-friendly self-hosted AI platform, has a role synchronization vulnerability present in versions 0.9.0 to 0.11.1. Specifically, in the backend, the functionality responsible for managing user roles did not properly invalidate the cached user records when changes were made via an administrator's role update. This allowed an attacker, who may demote a role through trusted headers or OAuth mapping, to maintain an open Socket.IO connection. Consequently, they could access and manipulate the collaborative notes of other users without detection, potentially leading to unauthorized data exposure until the connection was terminated. This issue has been addressed in version 0.11.1.

References