Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected Component Socket.IO session state and role-check callsites: backend/open_webui/socket/main.py (lines 330-351, connect hand…
| CVE ID | CVE-2026-44553 |
| Vendor | pip |
| Affected Product | open-webui |
| Vulnerability Type | Vulnerability |
| CVSS Score | 8.1 (HIGH) |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
backend/open_webui/socket/main.py (lines 330-351, connect handler — role snapshotted into SESSION_POOL)backend/open_webui/socket/main.py (lines 393-398, heartbeat handler — does not refresh role)backend/open_webui/socket/main.py (line 538, ydoc:document:join — uses cached role for admin check)backend/open_webui/socket/main.py (line 611, document_save_handler — uses cached role for admin check)backend/open_webui/routers/users.py (lines 557-633, role update — does not invalidate SESSION_POOL)backend/open_webui/routers/users.py (line 641, user delete — does not invalidate SESSION_POOL)Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.