CVE-2026-87014 open-webui CVE debrief

Who should care

Defenders managing Open WebUI instances, particularly those using role synchronization and OAuth mappings, should assess exposure and prioritize upgrading to version 0.11.1 or later.

Why it matters

CVE-2026-87014 is a medium-severity vulnerability in Open WebUI that could allow a demoted administrator to retain access to collaborative notes. Defenders managing Open WebUI instances should assess exposure and prioritize upgrading to version 0.11.1 or later.

• An administrator demoted through a trusted role header or OAuth role mapping could retain access to collaborative notes
• Retained access could allow reading or editing of every user's collaborative notes until the Socket.IO connection closes
• Defenders need to verify and upgrade to version 0.11.1 or later to mitigate this issue
• Role mappings and synchronization require review and correction to prevent similar issues

Technical summary

The vulnerability exists in the role synchronization mechanism of Open WebUI, specifically in the backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py files. An administrator's database role could be updated without invalidating the cached user record, allowing a demoted administrator to retain access to collaborative notes via an open Socket.IO connection. This issue allows a demoted administrator to potentially read or edit collaborative notes of all users until the Socket.IO connection closes. The fix in version 0.11.1 ensures that user records are properly invalidated upon role changes.

Defensive priority

Defenders should prioritize verifying and upgrading to version 0.11.1 or later, reviewing role mappings and ensuring proper invalidation of user records.

Recommended defensive actions

• Verify and upgrade to Open WebUI version 0.11.1 or later
• Review and correct role mappings and synchronization
• Ensure proper invalidation of user records on role changes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. Vendor advisories and patch notes are available. The issue is fixed in version 0.11.1. Defenders should verify and upgrade to the fixed version, review role mappings, and ensure proper invalidation of user records on role changes. The vulnerability allows a demoted administrator to retain access to collaborative notes via an open Socket.IO connection, potentially allowing reading or editing of every user's collaborative notes until

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.