PT-2026-39281 · Unknown · Open-Webui

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-44564

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0

Description The ydoc:document:update Socket.IO event handler fails to verify if a sender has write permissions, checking only if the sender is a member of the document's Socket.IO room. Users with read-only access can join this room via ydoc:document:join, which only requires read permission. Consequently, a user with read-only access can emit ydoc:document:update events to modify the in-memory Yjs document state, which is then broadcast to all collaborators in real time. While the document save handler() function correctly verifies write permissions before saving to the database, the tampered content remains visible to all collaborators and can be permanently persisted if a user with write access saves the document.

Recommendations Update to version 0.9.0.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-44564

GHSA-VRFH-RJ4Q-RMHR

Affected Products

Open-Webui

References · 5

• https://github.com/open-webui/open-webui/security/advisories/GHSA-vrfh-rj4q-rmhr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44564 · Security Note
• https://osv.dev/vulnerability/GHSA-vrfh-rj4q-rmhr · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://t.me/CVEtracker/53948 · Telegram Post