CVE-2026-44553 - Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Back Back to CVE browser

HIGH

Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Published May 15, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.39%

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, administrative role changes and user deletions do not iterate SESSION_POOL to disconnect affected sessions. As a result, a user whose admin role has been revoked retains admin privileges within their existing Socket.IO session for as long as they keep the connection alive (via automatic heartbeats). The gap is exclusive to the Socket.IO session cache. This vulnerability is fixed in 0.9.0.

Affected products

Vendor Open-Webui Product Open-Webui Default
n/a
- Version
  < 0.9.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Open-Webui

n/a

Version	Status	Constraints
< 0.9.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-384

CWE-613

CWE-863

Incorrect Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30615
Advisory
https://github.com/advisories/GHSA-45m8-cpm2-3v65
Advisory
https://github.com/open-webui/open-webui/security/advisories/GHSA-45m8-cpm2-3v65
x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44553

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30615		Advisory
https://github.com/advisories/GHSA-45m8-cpm2-3v65		Advisory
https://github.com/open-webui/open-webui/security/advisories/GHSA-45m8-cpm2-3v65		x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44553