GHSA-gmfw-g93r-vg53: Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Summary The Socket.IO server is configured with always_connect=True (lines 78, 91 in backend/open_webui/socket/main.py) and the connect handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions. Vulnerable Code ydoc:awareness:update (line 741) — No auth check at all @sio.on('ydoc:awareness:update') async def yjs_awareness_update(sid, data): document_id = data['document_id'] user_id = data.get('user_id', sid) update = data['update'] No SESSION_POOL check, no room membership check await sio.emit( 'ydoc:awareness:update', {'document_id': document_id, 'user_id': user_id, 'update': update}, room=f'doc_{document_id}', skip_sid=sid, ) ydoc:document:leave (line 711) — No auth check at all @sio.on('ydoc:document:leave') async def yjs_document_leave(sid, data): document_id = data['document_id'] user_id = data.get('user_id', sid) No auth check await YDOC_MANAGER.remove_user(document_id=document_id, user_id=sid) await sio.emit('ydoc:user:left', {'document_id': document_id, 'user_id': user_id}, room=f'doc_{document_id}') Root Cause: always_connect=True (line 78) sio = socketio.AsyncServer( always_connect=True, # Never rejects connections ... ) The connect handler (line 329) adds authenticated users to SESSION_POOL but never returns False or raises an exception for unauthenticated connections. Exploitation 1. An unauthenticated attacker connects via Socket.IO (no token needed) 2. The attacker emits ydoc:awareness:update with: - document_id: a known/guessed note UUID (format: note:{uuid}) - user_id: spoofed to impersonate any user - update: arbitrary awareness data (fake cursor positions, selections) 3. The fake awareness data is broadcast to all legitimate users in the document room 4. The attacker can also emit ydoc:document:leave with spoofed user_id to broadcast fake ydoc:user:left events Impact - UI disruption: Fake cu