CVE-2026-87014

Executive Summary

CVE-2026-87014 is an insufficient session expiration vulnerability (CWE-613) in Open WebUI, a self-hosted AI platform. From version 0.9.0 until 0.11.1, role synchronization logic in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated a user's database role without invalidating the user record cached by backend/open_webui/socket/main.py. An administrator who is demoted via a trusted role header or OAuth role mapping can retain an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closes. The flaw is rated CVSS 6.5 (Medium), requires high privileges to trigger, and is fixed in version 0.11.1.

Technical Analysis

The root cause is a cache/state desynchronization between the authorization persistence layer and the real-time Socket.IO session layer.

Open WebUI supports role assignment and synchronization through two external mechanisms: a trusted reverse-proxy header and OAuth role mapping. When an administrator's role changes — for example, demoted from admin to a standard user — the role synchronization routines in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py write the new role to the database. However, the user record cached in memory by the Socket.IO server (backend/open_webui/socket/main.py) is not invalidated or refreshed at the moment of the role change.

Socket.IO maintains persistent, long-lived WebSocket connections. As long as a connection remains open, the server continues to service events using its cached view of the user — the pre-demotion, administrator-privileged record. Authorization checks that depend on the cached record therefore continue to succeed for collaborative-note operations, even though the authoritative database state now reflects a lower privilege level.

This is a classic CWE-613 (Insufficient Session Expiration) condition: the privilege change is not propagated to the active session, so the prior authorization grant outlives the event that revoked it. The vulnerability class is session/authorization state desynchronization affecting a persistent real-time channel. No specific function names inside the synchronization routines or socket handler are disclosed in the source description; the described behavior is a failure to invalidate the cached user record on role change.

The effective authorization boundary is only restored when the stale Socket.IO connection closes naturally (disconnect, token refresh, or server restart). Any collaborative-note read or edit performed over that stale connection remains authorized under the old role.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class (CWE-613 session state desynchronization) and the behavior described in the NVD entry.

1. Reconnaissance / target identification. The attacker is already an administrator of the Open WebUI instance, or holds credentials mapped to an administrative role via a trusted role header or OAuth role mapping. In the typical scenario, the demotion is not an attacker action — it is an administrative response (e.g., offboarding, incident response, or privilege reduction). The attacker's precondition is simply having an active Socket.IO connection open at the time of demotion.

2. Triggering the flaw class. The administrator's role is updated in the database through the role synchronization path (trusted role header or OAuth role mapping). Because the Socket.IO server's cached user record is not invalidated, the demotion has no effect on the already-open connection. The attacker does nothing special to "exploit" — the application fails to enforce the new role on the live channel.

3. Action over the stale session. While the connection remains open, the attacker issues collaborative-note read or edit operations over the persistent Socket.IO channel. These are authorized against the stale cached record, which still reflects administrative privileges. No fabricated payload details are asserted here; the mechanism is the reuse of an unexpired authorized session after a privilege reduction.

4. Post-exploitation impact. Confidentiality and integrity of all users' collaborative notes are affected — the attacker can read or modify other users' note content. There is no availability impact. Because the attacker is a (former) administrator, the blast radius extends to every user's collaborative notes reachable by that role. The window of exposure lasts until the stale connection closes.

Impact Assessment

CVSS 3.1 base score 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N:

• AV:N — the vulnerability is reachable over the network via the Socket.IO interface.
• AC:L — no unusual conditions beyond holding an open connection are required.
• PR:H — the attacker must already possess administrative privileges (or a role mapped to admin).
• UI:N — no user interaction is required.
• S:U — impact is confined to the Open WebUI authorization scope.
• C:H / I:H — high confidentiality and integrity impact on all users' collaborative notes.
• A:N — no availability impact.

Business impact: Failure to revoke live privileges undermines defensive privilege-reduction actions. If an administrator is demoted during offboarding or incident response, they can continue accessing and tampering with user data. For organizations relying on Open WebUI collaborative notes for sensitive content, this represents unauthorized data exposure and integrity tampering. The effect is persistent (connection-scoped) rather than momentary, widening the exposure window.

Blast radius: A single authenticated administrator with one open Socket.IO connection can affect the collaborative notes of every user in the instance. Multi-tenant or shared deployments with broad note-sharing increase exposure.

Detection Guidance

Sigma Rule

title: Open WebUI Admin Role Demotion Without Socket Session Invalidation (CVE-2026-87014)
id: 8b1c2d3e-4f5a-6b7c-8d9e-0a1b2c3d4e5f
status: experimental
description: Detects administrative role changes in Open WebUI followed by continued collaborative-note activity, indicating stale Socket.IO session reuse after demotion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87014
author: valtersit.com
date: 2026/01/01
logsource:
  product: open_webui
  service: application
detection:
  selection_role_change:
    event|contains:
      - 'role'
      - 'oauth'
      - 'trusted_header'
  selection_admin_to_user:
    new_role: 'user'
    old_role: 'admin'
  selection_note_activity:
    event|contains:
      - 'collaborative_notes'
      - 'socket'
  condition: selection_admin_to_user and selection_note_activity
fields:
  - user_id
  - old_role
  - new_role
  - socket_id
falsepositives:
  - Legitimate note activity by a user whose role was changed by an automated provisioning system
level: medium
tags:
  - attack.t1078
  - cve.2026.87014

YARA Rule

rule CVE_2026_87014_Open_WebUI_Stale_Session
{
    meta:
        description = "Detects references to role synchronization and Socket.IO paths associated with CVE-2026-87014 in Open WebUI source trees"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87014"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $p1 = "backend/open_webui/routers/auths.py" ascii
        $p2 = "backend/open_webui/utils/oauth.py" ascii
        $p3 = "backend/open_webui/socket/main.py" ascii
        $r1 = "role" ascii
        $r2 = "oauth" ascii
        $s1 = "socket" ascii

    condition:
        (any of ($p1, $p2, $p3)) and $r1 and ($r2 or $s1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87014 Open WebUI Possible Stale Socket.IO Session After Role Demotion"; flow:established,to_server; http.uri; content:"/socket.io/"; http.header; content:"Upgrade"; nocase; http.header; content:"websocket"; nocase; reference:cve,2026-87014; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87014; classtype:attempted-user; sid:202687014; rev:1; metadata:affected_product Open_WebUI, created_at 2026_01_01;)

Elastic Detection

sequence by user.id with maxspan=10m
  [ authentication where event.action == "role_change" and user.target.roles : "user" ]
  [ network where network.protocol == "websocket" and url.path : "/socket.io/*" ]

Splunk SPL Query

index=open_webui (event_source=auths OR event_source=oauth OR event_source=socket)
| search ("role_change" OR "role_update" OR "demote" OR "trusted_header" OR "oauth_mapping")
| transaction user_id maxspan=15m
| search event_source=socket AND (notes OR collaborative OR socket)
| table _time user_id old_role new_role event_source action
| sort - _time

Wazuh OSSEC Rule

<group name="open_webui,cve-2026-87014,">
  <rule id="2026871" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_source">\.+</field>
    <description>CVE-2026-87014 - Open WebUI role change detected, verify Socket.IO session invalidation</description>
    <regex>role.*(user|admin)</regex>
    <options>alert_by_email</options>
  </rule>
  <rule id="2026872" level="12">
    <if_sid>2026871</if_sid>
    <field name="event_source">socket</field>
    <description>CVE-2026-87014 - Socket.IO collaborative-note activity after role demotion</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or OSV packages are named in the data provided. The NVD description itself states the issue is fixed in version 0.11.1, but no patch source is tracked; treat any upgrade as requiring independent verification.

1. Immediate mitigations

   • When an administrator's role is changed, forcibly terminate their existing Socket.IO connections (invalidate the server-side cached user record and require re-authentication). If the platform does not expose this, disrupt live sessions by restarting the Open WebUI application or the Socket.IO service so cached user records are rebuilt.
   • Restrict administrative accounts to the minimum necessary population and avoid assigning admin via broadly scoped trusted role headers or OAuth role mappings.
   • Place Open WebUI behind an authenticating reverse proxy and terminate or rotate sessions on role changes at the proxy/session layer.
   • Monitor for administrative role changes and verify that the affected user's live connection is dropped.

2. Patch / upgrade steps

   • Upgrade Open WebUI to 0.11.1 or later, which the NVD description identifies as the fixed version.
   • After upgrading, confirm the deployed version and re-test the role-demotion scenario: demote an administrator with an open Socket.IO connection and verify the note read/edit operations are rejected.
   • Because patch confidence is 0/4, validate the fix against your environment rather than assuming coverage.

3. Long-term hardening

   • Adopt an authorization model where privileged operations re-validate against authoritative state (database) at execution time rather than trusting cached session records.
   • Enforce session revocation on any privilege change as a standing control, and bound the lifetime of persistent real-time connections with periodic re-authentication.
   • Maintain change monitoring/alerting on role transitions for administrative accounts and treat unexpected post-demotion activity as a potential incident (T1078 — Valid Accounts).

References

• NVD — CVE-2026-87014: https://nvd.nist.gov/vuln/detail/CVE-2026-87014
• Open WebUI project repository (review release notes for 0.11.1): https://github.com/open-webui/open-webui
• CWE-613 — Insufficient Session Expiration: https://cwe.mitre.org/data/definitions/613.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities Catalog (currently does NOT list CVE-2026-87014): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or known in-the-wild exploitation is documented for CVE-2026-87014 as of this report. No EPSS score is available; it should not be assumed. No threat actor campaign has been attributed. All exploit-chain content above is inferred from the vulnerability class and the NVD description and should be re-validated as new intelligence emerges.