CVE-2026-109289

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109289
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109289.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109289
Aliases
  • GHSA-6g45-8g27-fh8q
Published
2026-10-12T16:04:51Z
Modified
2026-10-13T02:46:40Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket
Details

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-613"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109289.json"
}
References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type
GIT
Repo
https://github.com/open-webui/open-webui
Events
Introduced
79f04379801622181ef9c591374a285eac4e1c4d
Fixed
8bd8b4fac5e059578ac0c74b3c18d11139f88b7d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.8.8"
        },
        {
            "fixed":  "0.11.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.8.10
v0.8.11
v0.8.12
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109289.json"