Open WebUI allowed a client to transmit "execute:python" and "execute:tool" Socket.IO events to any session identified by a socket ID, after checking only that the session was connected. This flaw permits an authenticated user to discover another user’s socket ID through the ydoc:document:join event and run code interpreter Python or tools within that user’s session, thereby exposing the session’s data and execution context. The weakness corresponds to failures in confidentiality, authorization, and input validation, reflected in identifiers such as CWE-200, CWE-639, CWE-862 and CWE-94.

The vulnerability affects open-webui deployments with versions earlier than 0.10.0. All authenticated users on these installations who can observe or guess another user’s socket ID can potentially exploit the flaw.

With a CVSS score of 7.7, the issue is classified as high severity. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only that an attacker be authenticated to the platform and learn a target user’s socket ID, a scenario that can arise when the ydoc:document:join event is enabled. Thus the attack vector relies on legitimate user authentication coupled with unauthorized session ID reuse, allowing cross-user privilege escalation and code execution.