{"vulnerability": "cve-2026-87014", "sightings": [{"uuid": "34ac219f-ad07-48bf-957b-8c9dd27b2d7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-87014", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-wjwr-xfp9-r66p", "content": "", "creation_timestamp": "2026-09-11T00:35:41.171568Z"}, {"uuid": "1eea37c3-8278-4cfe-9fd4-402796e3073d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87014", "type": "seen", "source": "https://gist.github.com/alon710/57a0435a9d7a14ff9a1f3ca71156beef", "content": "# CVE-2026-87014: CVE-2026-87014: Session Desynchronization and Privilege Persistence in Open WebUI\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-87014\n\n## Summary\nOpen WebUI from version 0.9.0 to 0.11.1 is vulnerable to a state desynchronization and privilege persistence flaw. When an administrator is demoted to a standard user via Single Sign-On (SSO) role synchronization, the local database is updated, but their active Socket.IO connection is not invalidated. Because the WebSocket handlers authorize operations using the cached role in the socket context, the demoted user retains administrative read and write access to all collaborative notes.\n\n## TL;DR\nA session desynchronization flaw in Open WebUI lets demoted administrators retain administrative read/write access to all users' collaborative notes via active, uninvalidated Socket.IO connections.\n\n## Technical Details\n\n- **CWE ID**: CWE-613 / CWE-863\n- **Attack Vector**: Network\n- **CVSS Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00278 (0.28%)\n- **Impact**: High (Confidentiality & Integrity)\n- **Exploit Status**: No public PoC\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Open WebUI\n- **Open WebUI**: >= 0.9.0, < 0.11.1 (Fixed in: `0.11.1`)\n\n## Mitigation\n\n- Upgrade to Open WebUI version 0.11.1 or later to leverage the new event-driven session invalidation mechanism.\n- Perform a complete application service or container restart following administrative or automated SSO role demotions to clear stateful connections.\n- Monitor active Socket.IO connection actions for mismatches between database roles and cached connection-time roles.\n\n**Remediation Steps:**\n1. Verify the currently deployed version of Open WebUI by checking the administration panel settings or running 'pip show open-webui'.\n2. If the version is between 0.9.0 and 0.11.0 (inclusive), schedule a maintenance window.\n3. Execute 'pip install --upgrade open-webui' or update your container deployment configuration to pull tag 'v0.11.1' or later.\n4. Restart the application service to clear memory-cached socket contexts.\n\n## References\n\n- [GitHub Security Advisory GHSA-wjwr-xfp9-r66p](https://github.com/open-webui/open-webui/security/advisories/GHSA-wjwr-xfp9-r66p)\n- [Fix Commit](https://github.com/open-webui/open-webui/commit/ce3c175e260709f359d7e6cbb3132f0572098b95)\n- [Open WebUI v0.11.1 Release](https://github.com/open-webui/open-webui/releases/tag/v0.11.1)\n- [NVD - CVE-2026-87014](https://nvd.nist.gov/vuln/detail/CVE-2026-87014)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-87014) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-11T16:33:17.602901Z"}]}