CVE-2026-59216 is a high severity flaw (CVSS 7.7) in Open WebUI before 0.10.0. The get_event_call function delivered code execution events to a client supplied session ID after checking only that the session was connected. Authenticated users could run code in another user session. Upgrade to 0.10.0.
What's affected
- Open WebUI before 0.10.0.
- Fixed version: 0.10.0.
- The attacker must be an authenticated user.
How to check if you're exposed
For pip run pip show open-webui. For Docker check the image tag with docker image ls. Anything below 0.10.0 is affected. Single user installs have little exposure, while shared instances have more.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Upgrade to Open WebUI 0.10.0.
- Review who has accounts on shared instances and remove stale ones.
- Check tool and code interpreter settings, and turn off what nobody needs.
- Review logs and Tools or Functions for activity nobody on your team can explain.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
The record lists CWE-200 (Exposure of Sensitive Information), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-862 (Missing Authorization) and CWE-94 (Code Injection). The advisory describes a missing ownership check. Code events were sent to whatever socket ID the client supplied, as long as that session was connected. A user could learn another person's socket ID through the document join event, then direct code interpreter Python or tool calls into that person's session.
The upstream commit title says the fix scopes the event caller to the requesting user's own session. That is the right shape of fix: bind the target to the identity of the caller, never to an identifier the caller can choose.
The score is held down by needing a login and high attack complexity. The CISA KEV flag is false.
Real time features such as collaborative documents rely on socket identifiers, and leaking one is not usually thought of as a security event. This flaw shows why such identifiers should be treated as secrets, or better, never trusted as proof of ownership.
Quick check
How is this different from CVE-2026-59214?
That one is about shared chat code run in the browser. This one is about events routed to another user session. Both are fixed in 0.10.0.
Sources
Last reviewed: 19 October 2026.
