CVE-2026-59715: 
Open WebUI vulnerability analysis and mitigation

CVE-2026-59715 is a missing authentication vulnerability in Open WebUI's Socket.IO collaborative document handlers, allowing unauthenticated attackers to manipulate document collaboration state. It affects Open WebUI versions 0.6.16 through 0.10.0 (exclusive), a self-hosted AI platform. The vulnerability was disclosed on July 2, 2026 via a GitHub Security Advisory and published to NVD on July 9, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, though the original advisory scores it as 3.1 (Low) (GitHub Advisory).

The root cause is CWE-306 (Missing Authentication for Critical Function): the Socket.IO server is initialized with always_connect=True, which causes the server to accept all incoming WebSocket connections without rejecting unauthenticated clients. Two specific event handlers — ydoc:awareness:update (line 741) and ydoc:document:leave (line 711) in backend/open_webui/socket/main.py — perform no SESSION_POOL membership check, unlike their sibling handlers (ydoc:document:join, ydoc:document:update, ydoc:document:state). An attacker with network access can connect via Socket.IO without any authentication token, then emit crafted events with a spoofed user_id and a known or guessed document UUID (format: note:{uuid}) to inject arbitrary awareness data or fake departure events into live collaborative sessions (GitHub Advisory, Fix PR).

Successful exploitation allows an unauthenticated attacker to inject fake cursor positions, user presence data, and selection states into collaborative document sessions, disrupting the UI experience for all legitimate participants. Attackers can also spoof ydoc:user:left events attributed to any user ID, causing false disconnection notifications. Importantly, actual document content is not accessible through this vulnerability — the ydoc:document:update handler enforces write permission checks — so confidentiality impact is none, but integrity and availability of the collaborative editing experience are degraded. The attack also enables resource exhaustion through unlimited unauthenticated WebSocket connections (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Open WebUI instances running versions 0.6.16–0.9.x (e.g., via Shodan or Censys searching for Open WebUI banners). Obtain or guess a target collaborative note's document UUID (format: note:{uuid}).
2. Unauthenticated Socket.IO connection: Connect to the target's Socket.IO endpoint without any authentication token. Because always_connect=True is set, the server accepts the connection unconditionally.
3. Emit ydoc:awareness:update: Send a crafted Socket.IO event with the following payload:

   {
     "document_id": "note:<target-uuid>",
     "user_id": "<victim-user-id-to-impersonate>",
     "update": "<arbitrary awareness data, e.g., fake cursor position>"
   }

   The server broadcasts this to all users in the document room without verifying the sender's identity.
4. Inject fake departure events: Emit ydoc:document:leave with a spoofed user_id to broadcast a fake ydoc:user:left event, making legitimate users appear to have left the session.
5. Sustain disruption or exhaust resources: Maintain multiple unauthenticated WebSocket connections to continuously inject false presence data or exhaust server resources (GitHub Advisory).

• Network: Unexpected Socket.IO connections from unknown or external IP addresses to the Open WebUI WebSocket endpoint without a valid authentication token; high volume of unauthenticated WebSocket connection attempts.
• Logs: Server logs showing ydoc:awareness:update or ydoc:document:leave events from sessions not present in SESSION_POOL; repeated events with the same document_id from multiple unauthenticated sessions.
• Process/Application Behavior: Legitimate users in collaborative document sessions reporting unexpected cursor movements, phantom user presence indicators, or false notifications that other users have left the document.
• Resource Indicators: Abnormally high number of concurrent WebSocket connections to the Socket.IO server, potentially indicating connection exhaustion attempts (GitHub Advisory).

The primary remediation is to upgrade Open WebUI to version 0.10.0 or later, which adds SESSION_POOL authentication checks to both ydoc:awareness:update and ydoc:document:leave handlers, enforces room membership verification before broadcasting, and fixes the user_id to the authenticated identity rather than the client-supplied value (v0.10.0 Release, Fix Commit). If immediate patching is not possible, implement network-level access controls (e.g., firewall rules or reverse proxy authentication) to restrict Socket.IO WebSocket connections to authenticated users only, or place the Open WebUI instance behind a VPN or authenticated proxy to prevent unauthenticated external access (GitHub Advisory).

The vulnerability was reported by security researchers sfwani and Classic298, with the fix developed by Classic298 and merged by Open WebUI maintainer tjbck on June 16, 2026. The advisory notes that AI (Claude) was used to assist with source code review and drafting, with the researcher independently verifying findings against a live Docker instance. The fix was included in the v0.10.0 release, which the Open WebUI team flagged with a general security advisory recommending production deployments update at their earliest convenience (v0.10.0 Release, Fix PR).