Improper Authorization in Open WebUI - CVE-2026-44553
Published: May 5, 2026
Vulnerability identifier: #VU130167
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44553
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read and modify other users' notes.
The vulnerability exists due to improper access control in the Socket.IO session pool and Yjs collaborative document handlers when processing Socket.IO events after an administrative role change or user deletion. A remote user can keep a previously established Socket.IO session alive and send crafted ydoc document join and update events to read and modify other users' notes.
HTTP endpoints are not affected. Exploitation requires an active Socket.IO session that was established while the user still had the admin role, and the stale session can persist through heartbeat events.
Affected software
Open WebUI
How to mitigate CVE-2026-44553
Install security update from vendor's website.
Open WebUI - update to 0.9.0