SEPTEMBER 15, 2026
Live Feed
Back to database
Case File

CVE-2026-87014

MEDIUM · CVSS 6.5 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-09 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

The vulnerability affects the Open WebUI platform, where improper role synchronization allows an administrator to retain access to sensitive user data via an active Socket.IO connection, even after their privileges have been downgraded. This could lead to unauthorized access to collaborative notes, posing a risk to user privacy and data integrity. Organizations using versions 0.9.0 to 0.11.1 should prioritize updating to version 0.11.1 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-87014
Severity
MEDIUM
CVSS
6.5
EPSS
0.28%

Original NVD Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by backend/open_webui/socket/main.py. An administrator demoted through a trusted role header or OAuth role mapping could keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closed. This issue is fixed in version 0.11.1.