CVE-2026-59715

EUVD-2026-42623
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handlers accepted collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state. This issue is fixed in version 0.10.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.12%
Affected Products (NVD)
VendorProductVersion
openwebuiopen_webui
0.6.16 ≤
𝑥
< 0.10.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/open-webui/open-webui/commit/22f2fe1ffb66c993dad1e0b2b35514acaed2370e
https://github.com/open-webui/open-webui/pull/25946
https://github.com/open-webui/open-webui/releases/tag/v0.10.0
https://github.com/open-webui/open-webui/security/advisories/GHSA-gmfw-g93r-vg53
https://github.com/open-webui/open-webui/security/advisories/GHSA-gmfw-g93r-vg53