CVE-2026-54022: Open WebUI Authorization Bypass Leaks Private Notes

Technical summary

The ydoc:document:join Socket.IO handler in Open WebUI implements an ownership verification check that examines whether a document_id begins with the string 'note:'. However, the YdocManager storage abstraction normalizes identifiers by replacing colons with underscores before performing document lookups. This normalization inconsistency creates a logic gap: a request for note_12345 bypasses the colon-based authorization check but resolves to the same underlying Yjs document as note:12345, allowing the attacker to access and receive the document state without authorization. The vulnerability is classified as CWE-706 (Use of Incorrectly-Resolved Name) and CWE-863 (Incorrect Authorization), indicating both a name resolution failure and an authorization control defect.

Business impact

Private note data stored in Open WebUI instances can be accessed by any authenticated user without the note owner's knowledge or consent. For organizations using Open WebUI to store sensitive information—research notes, internal analysis, confidential project details—this creates a material confidentiality breach. The risk is elevated in multi-user deployments where trust levels vary. Unlike data exfiltration vulnerabilities that leave audit trails, unauthorized document access via this method may go undetected, as the attacker never modifies the document. Remediation requires immediate patching across all Open WebUI deployments handling sensitive data.

Affected systems

Open WebUI versions 0.8.10 and earlier are vulnerable. Any deployment allowing multiple authenticated users to access the platform is at risk. Self-hosted instances are the primary target surface, as Open WebUI is designed for offline operation. Vulnerability requires that the attacker possess valid authentication credentials (login) to the Open WebUI instance.

Exploitability

Exploitation requires valid login credentials, which moderately raises the barrier to entry. However, the authorization bypass itself is trivial to execute once authenticated—an attacker simply crafts a Socket.IO join request with an underscore-formatted document ID instead of the colon format. No special tools, timing, or user interaction are required. Discovery of target note IDs could rely on information disclosure, enumeration, or insider knowledge. The CVSS score of 5.3 (Medium) reflects the requirement for prior authentication, balanced against the high confidentiality impact.

Remediation

Upgrade Open WebUI to version 0.8.11 or later, which addresses the document_id normalization inconsistency. Organizations should prioritize patching instances in environments where multiple users have platform access or where notes contain sensitive information. No workarounds are available short of restricting user access or disabling the document-sharing feature.

Patch guidance

Apply the official Open WebUI update to 0.8.11 or newer. Verify the patch version in your deployment using the application's settings or version endpoint. If you operate a custom fork or deployment pipeline, ensure the YdocManager normalization logic and the Socket.IO authorization handler are both updated in sync. Test in a non-production environment first to confirm compatibility with your configuration, especially if you run custom authentication plugins.

Detection guidance

Monitor Socket.IO connection logs for join events targeting documents with underscore-formatted IDs (note_*) that do not match the canonical note: naming scheme. Correlate these join events with the requesting user's ID and the target document owner to identify potential unauthorized access attempts. Review Yjs document state snapshots for unexpected readers if audit logging is available. Network-level detection is difficult without Socket.IO payload inspection, so log-based detection at the application layer is preferred. Consider enabling verbose logging on the ydoc:document:join handler if available.

Why prioritize this

Although the CVSS score is Medium (5.3), the vulnerability merits higher prioritization in organizations managing sensitive or regulated data. The defect is trivial to exploit once authenticated, affects all versions prior to 0.8.11, and results in direct confidentiality loss with potential compliance implications (GDPR, HIPAA, etc.). Patch availability and low remediation friction should accelerate deployment schedules.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: (1) Network attack vector—exploitation occurs over the network via Socket.IO; (2) High complexity—the attacker must know or guess the target document ID and understand the underscore-colon substitution pattern; (3) Low privileges—authentication is required, placing the attack in the 'low' privilege category; (4) High confidentiality impact—the attacker gains full read access to the victim's private document; (5) No integrity or availability impact. The Medium severity rating appropriately captures a confidentiality-only breach requiring authentication, but organizations handling sensitive data should assess risk independently of this baseline score.

Frequently asked questions