Incorrect Authorization Affecting open-webui package, versions [,0.9.0)

open-webui is an Open WebUI

Affected versions of this package are vulnerable to Incorrect Authorization in the SESSION_POOL process. An attacker can maintain unauthorized access to other users' notes and modify their content by keeping an active Socket.IO session after their administrative privileges have been revoked or their user account has been deleted. This is only exploitable if the attacker had an active Socket.IO connection established while holding admin privileges and continues to keep the session alive after demotion or deletion.

• GitHub Advisory
• GitHub Commit