CVE-2026-87014: Open WebUI demoted admins keep

Q: Is CVE-2026-87014 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-87014, increasing the risk of exploitation.

Q: How to fix CVE-2026-87014?

Upgrade to Open WebUI 0.11.1 or later, which invalidates the cached socket user record on role change. Until patched, any tenant using trusted role headers or OAuth role mapping for admin assignment should force-terminate active Socket.IO sessions (or bounce the service) immediately after demoting an administrator, and audit recent admin role-downgrade events for anomalous note access during the exposure window. Detection: monitor for note read/edit activity attributed to a user ID shortly after that user's role was changed from admin to a lower privilege level, using existing audit logs or Socket.IO connection logs if available. Longer term, review who is provisioned as admin via automated header/OAuth mapping, since this class of bug specifically targets that provisioning path.

Q: What systems are affected by CVE-2026-87014?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted LLM web UI / chat platforms, Multi-user collaborative AI workspaces, Real-time (WebSocket) session layers in AI platforms.

Q: What is the CVSS score for CVE-2026-87014?

CVE-2026-87014 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.51%.

CISO Take

A stale-session bug in Open WebUI lets a user who is demoted from administrator — via a trusted role header or OAuth role mapping — keep reading and editing every user's collaborative notes for as long as their existing Socket.IO connection stays open, because the cached user object in the socket layer is never invalidated when the database role changes. The blast radius is contained to Open WebUI's own collaborative-notes feature and requires the attacker to already hold high privileges (PR:H), which caps severity at CVSS 6.5 medium, and the EPSS score of 0.28% confirms opportunistic mass exploitation is very unlikely — this is a targeted insider-risk and access-governance issue, not a spray-and-pray bug. There is no CISA KEV listing, no public exploit, and no Nuclei template, so treat it as a patch-and-move-on item rather than an emergency. Upgrade to Open WebUI 0.11.1 or later immediately on any instance where administrator roles are dynamically assigned via header trust or OAuth group mapping, and in the interim force-disconnect active Socket.IO sessions (or restart the service) whenever an admin's role is downgraded to close the exposure window.

Sources:NVDGitHub AdvisoryEPSSATLAS

What is the risk?

Medium severity (CVSS 6.5, C:H/I:H/A:N) with high privileges required for initial exploitation, which meaningfully limits who can trigger it — the attacker must already hold or have recently held administrator rights. Attack complexity is low and no user interaction is needed once the precondition (an open socket at demotion time) exists, so exploitation itself is trivial for anyone positioned to trigger it, including a departing or soon-to-be-demoted admin deliberately keeping a tab open. EPSS (0.28%) and the absence of KEV listing, public PoC, or scanner coverage indicate this is not being actively targeted and is unlikely to see broad opportunistic exploitation. The realistic risk is insider-driven: a disgruntled or compromised admin account can use this to retain read/write access to sensitive collaborative notes across the tenant even after being demoted.

How does the attack unfold?

Initial privilege

A user is granted administrator rights via a trusted role header or OAuth role mapping and opens a long-lived Socket.IO connection to Open WebUI.

AML.T0012

Role revocation without session sync

An administrator demotes the user's database role, but the cached user object in backend/open_webui/socket/main.py is not invalidated, leaving the open connection with stale admin privileges.

Persistence via stale session

The demoted user keeps the existing Socket.IO connection open, retaining admin-level access without needing to re-authenticate or perform any further action.

Impact: unauthorized data access

Using the still-privileged connection, the demoted user continues reading and editing every other user's collaborative notes until the connection closes, breaching confidentiality and integrity of shared data.

Initial privilege

A user is granted administrator rights via a trusted role header or OAuth role mapping and opens a long-lived Socket.IO connection to Open WebUI.

AML.T0012

Role revocation without session sync

An administrator demotes the user's database role, but the cached user object in backend/open_webui/socket/main.py is not invalidated, leaving the open connection with stale admin privileges.

Persistence via stale session

The demoted user keeps the existing Socket.IO connection open, retaining admin-level access without needing to re-authenticate or perform any further action.

Impact: unauthorized data access

Using the still-privileged connection, the demoted user continues reading and editing every other user's collaborative notes until the connection closes, breaching confidentiality and integrity of shared data.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.9.0, < 0.11.1	`0.11.1`
157.4K2 dependentsPushed 4d ago77% patched~22d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRHigh

UINone

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

Upgrade to Open WebUI 0.11.1 or later, which invalidates the cached socket user record on role change. Until patched, any tenant using trusted role headers or OAuth role mapping for admin assignment should force-terminate active Socket.IO sessions (or bounce the service) immediately after demoting an administrator, and audit recent admin role-downgrade events for anomalous note access during the exposure window. Detection: monitor for note read/edit activity attributed to a user ID shortly after that user's role was changed from admin to a lower privilege level, using existing audit logs or Socket.IO connection logs if available. Longer term, review who is provisioned as admin via automated header/OAuth mapping, since this class of bug specifically targets that provisioning path.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassPrivacy ViolationFrameworkAML.T0012- Valid Accounts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2.2-Roles, responsibilities and authorities

NIST AI RMF

MANAGE 2.3-Mechanisms are in place to supersede, disengage, or deactivate AI systems

OWASP LLM Top 10

LLM06-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-87014?

A stale-session bug in Open WebUI lets a user who is demoted from administrator — via a trusted role header or OAuth role mapping — keep reading and editing every user's collaborative notes for as long as their existing Socket.IO connection stays open, because the cached user object in the socket layer is never invalidated when the database role changes. The blast radius is contained to Open WebUI's own collaborative-notes feature and requires the attacker to already hold high privileges (PR:H), which caps severity at CVSS 6.5 medium, and the EPSS score of 0.28% confirms opportunistic mass exploitation is very unlikely — this is a targeted insider-risk and access-governance issue, not a spray-and-pray bug. There is no CISA KEV listing, no public exploit, and no Nuclei template, so treat it as a patch-and-move-on item rather than an emergency. Upgrade to Open WebUI 0.11.1 or later immediately on any instance where administrator roles are dynamically assigned via header trust or OAuth group mapping, and in the interim force-disconnect active Socket.IO sessions (or restart the service) whenever an admin's role is downgraded to close the exposure window.

Is CVE-2026-87014 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-87014, increasing the risk of exploitation.

How to fix CVE-2026-87014?

Upgrade to Open WebUI 0.11.1 or later, which invalidates the cached socket user record on role change. Until patched, any tenant using trusted role headers or OAuth role mapping for admin assignment should force-terminate active Socket.IO sessions (or bounce the service) immediately after demoting an administrator, and audit recent admin role-downgrade events for anomalous note access during the exposure window. Detection: monitor for note read/edit activity attributed to a user ID shortly after that user's role was changed from admin to a lower privilege level, using existing audit logs or Socket.IO connection logs if available. Longer term, review who is provisioned as admin via automated header/OAuth mapping, since this class of bug specifically targets that provisioning path.

What systems are affected by CVE-2026-87014?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted LLM web UI / chat platforms, Multi-user collaborative AI workspaces, Real-time (WebSocket) session layers in AI platforms.

What is the CVSS score for CVE-2026-87014?

CVE-2026-87014 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

Self-hosted LLM web UI / chat platformsMulti-user collaborative AI workspacesReal-time (WebSocket) session layers in AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by backend/open_webui/socket/main.py. An administrator demoted through a trusted role header or OAuth role mapping could keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closed. This issue is fixed in version 0.11.1.

Exploitation Scenario

An organization uses OAuth group mapping to grant administrator rights in Open WebUI. A user is granted temporary admin access for a project, opens the web UI, and establishes a long-lived Socket.IO connection. When the project ends, an administrator revokes the OAuth group membership, demoting the user's database role back to standard user — but because the socket layer never re-checks the cached role, the demoted user's still-open browser tab continues to receive and send collaborative-notes read/write events as if still an admin, letting them silently continue reading or modifying every other user's private notes until they close the tab or the connection drops. The same technique could be used deliberately by an admin who anticipates being demoted, keeping a background tab open specifically to retain access after the fact.

Weaknesses (CWE)

CWE-613Insufficient Session ExpirationPrimary CWE-863Incorrect AuthorizationPrimary CWE-613DEPRECATED: Insufficient Session Expiration CWE-863Incorrect Authorization

CWE-613 — Insufficient Session Expiration: This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.

Source: MITRE CWE corpus.