Open WebUI Unauthenticated Terminal Access via WebSocket Role Check Bypass (CVE-2024-XXXX)

Vulnerability Overview Title: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check Description: The terminal WebSocket route, when verifying its initial JWT message, does not validate through the HTTP dependency chain nor apply the enforcement of permission checks. This means that even accounts that are unapproved, approved but subsequently deactivated, can open interactive terminal sessions, whereas the HTTP terminal endpoint would reject such requests. The missing control is the verification of user roles rather than terminal access rights themselves. Impact Scope Affected Versions: >= 0.8.8, = 0.11.0 Severity: 6.3 / 10 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: Low Remediation Fixed Version: v0.11.0 Fix Details: Fixed in v0.11.0 via #27537. Token decoding, revocation checks, user lookup, and role verification have been consolidated into a single helper function. Both the terminal WebSocket route and the Socket.IO handshake now utilize this function. The set of roles is shared with the HTTP gateway via a constant, preventing drift between the two. A full upgrade resolves this issue without requiring any configuration changes. Preconditions At least one terminal server must be configured (not configured by default), with access permissions covering the account: public read or a group to which the account belongs. The attacker requires a valid, non-expired JWT for the pending account and the terminal server ID. Both can be obtained via an account that is pending approval after registration or an account that held access rights but was subsequently deactivated. Tokens are not revoked upon deactivation and persist by default for four weeks. Deployments without a configured terminal server or where terminal permissions are restricted to administrators only are not affected. Impact The deployment loses the boundary for terminal access control based on account approval status. Unapproved or deactivated accounts can gain interactive shell access, file browsing, and access to tools within the terminal backend, provided their tokens remain valid. Since the HTTP terminal route correctly denies access to the same accounts, a divergence exists between the two planes: when an administrator deactivates a user, HTTP access is revoked, while WebSocket connectivity remains functional. Terminal access permissions themselves are not bypassed: accounts lacking permission are still denied, meaning this vulnerability only expands the scope of already broadly shared terminal access (either via group membership or account permissions). Root Cause Affected Component: The helper function in , used by the WebSocket route. This route was introduced starting from build v0.8.8. WebSocket handshakes cannot use FastAPI dependencies; therefore, this route re-implements authentication. The re-implementation duplicated only the visible portion of the token—decoding it and checking for the presence of a user line—while silently omitting parts present in two independent code paths. There is no shared definition for authenticated users, and only one of the paths was updated when role-based permissions were introduced. Credits Reporter: @repoistory

Goal Reached Thanks to every supporter — we hit 100%!

Open WebUI Unauthenticated Terminal Access via WebSocket Role Check Bypass (CVE-2024-XXXX)

More from this source