{"data":{"id":"ff21f0af-9fab-4ddc-ac36-46e312dad2f0","title":"GHSA-gmfw-g93r-vg53: Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)","summary":"Open WebUI's Socket.IO server accepts unauthenticated WebSocket connections and has two collaborative document handlers (`ydoc:awareness:update` and `ydoc:document:leave`) that lack authentication checks. This allows an attacker without login credentials to spoof user presence, fake cursor positions, and broadcast false events to legitimate users editing documents together.","solution":"The source suggests three fixes: (1) Set `always_connect=False` or reject unauthenticated connections in the `connect` handler, (2) Add `SESSION_POOL` checks to `ydoc:awareness:update` and `ydoc:document:leave` (similar to how other Ydoc handlers like `ydoc:document:join` correctly verify membership), and (3) Add room membership verification before broadcasting to document rooms.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-gmfw-g93r-vg53","publishedAt":"2026-07-24T16:59:44.000Z","cveId":"CVE-2026-59715","cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["open-webui@>= 0.6.16, < 0.10.0 (fixed: 0.10.0)"],"affectedVendors":[],"affectedVendorsRaw":["Open WebUI"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00222,"patchAvailable":true,"disclosureDate":"2026-07-24T16:59:44.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":null}}