Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109289Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

Medium 6.3

In plain English

A medium-severity security flaw in open-webui from open-webui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 88.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.

Affected products (as reported)

Vendor	Product	Versions
open-webui	open-webui	0.8.8 – before 0.11.4

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

GitHub Security Advisory (GHSA-6g45-8g27-fh8q) vendor-advisory
VulnCheck Advisory: Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket third-party-advisory