Deactivated users keep terminal command execution via an already open terminal WebSocket

Deactivated users keep terminal command execution via an already open terminal WebSocket

Summary

When an administrator deactivates a user by setting their role to pending, Open WebUI refuses that user's later HTTP requests and new WebSocket handshakes. A terminal WebSocket the user had already opened stayed connected and kept forwarding their commands to the terminal server. Nothing re-checked the user's access once the connection was established, so deactivation did not cut off an open terminal.

Preconditions

• An administrator has configured at least one terminal server connection (none exist by default) and granted the user access to it.
• The user has a terminal session open in the Open WebUI interface at the moment they are deactivated.
• No other knowledge is needed. The user only keeps the already open terminal tab.

Deployments without a configured terminal server are not affected.

Impact

A deactivated user who kept a terminal open can keep running commands on the terminal server as before, including reading and writing files there, until the connection closes for some other reason. The access is the same the user held before deactivation, so exploitation needs no skill, only an open tab at the right moment. Deactivation therefore does not give an administrator an immediate way to cut off a terminal user. Accounts that never had terminal access gain nothing.

Fix

Fixed in commit e8bd0661d. Every open terminal session now re-checks the user's access every ten seconds: the token is still valid, the user still exists and holds an approved role, the terminal server is still configured and enabled, and the user still has access to it. The session is closed when any check fails. After upgrading, a revoked user loses an open terminal within about ten seconds.

Root cause