CVSS 3.1
3.5 lowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NCVE-2026-45316
Low (3.5) in openwebui open webui. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in open-webui 0.9.3.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the POST /api/v1/notes/{id}/pin endpoint performs a write operation (toggling the is_pinned field) but only checks for read permission. Users with read-only access to a shared note can pin/unpin it, which is a state-modifying action that should require write permission. This vulnerability is fixed in 0.9.3.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openwebui:open_webui
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jx2x-j75f-xq3j | PyPI | open-webui | <0.9.3 | 0.9.3 |
| PYSEC-2026-2745 | PyPI | open-webui | <0.9.3 | 0.9.3 |