CVE-2026-109289
Received Received - Intake

Improper Authorization in Open WebUI Terminal Commands

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109289
EUVD
EUVD-2026-97591

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-webui open-webui 0.8.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open WebUI versions 0.8.8 to 0.11.3 have an improper authorization flaw. Deactivated users can still execute terminal commands via an open WebSocket because the terminal proxy route only checks access on the first message. This allows unauthorized users to run commands and access files on the terminal server.

Detection Guidance

Check Open WebUI versions between 0.8.8 and 0.11.3 for the vulnerability. Monitor terminal WebSocket connections for unusual activity from deactivated users. Review logs for persistent terminal sessions after user deactivation.

Impact Analysis

If you use Open WebUI in versions 0.8.8 to 0.11.3, deactivated accounts could still perform actions like running commands or accessing sensitive files. This could lead to data breaches, unauthorized system changes, or further exploitation of your environment.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by allowing unauthorized access to sensitive data or systems. Unauthorized command execution may lead to data leaks or improper handling of personal health information, resulting in legal or regulatory penalties.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later immediately. Review and terminate all active terminal sessions. Audit user permissions and disable any deactivated accounts with active sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart