CVE-2026-109289

Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

State: Published
Severity: 5.3 Medium
Published: Oct 12, 2026
Updated: Oct 23, 2026
Reserved: Oct 12, 2026

Description

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulnCheck

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
open-webuiopen-webui	0.8.8 to before 0.11.4Affected 0.11.4Not affected

References

GitHub Security Advisory (GHSA-6g45-8g27-fh8q)vendor-advisory
VulnCheck Advisory: Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocketthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.