PT-2026-41169 · Unknown · Open-Webui

Published 2026-05-09 · Updated 2026-05-16 · CVE-2026-45316

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.3

Description The "POST /api/v1/notes/{id}/pin" endpoint performs a write operation by toggling the is pinned field but incorrectly validates only for read permission. This allows users who have read-only access to a shared note to pin or unpin it, effectively modifying the state of the note without the required write authorization. This action is visible to the note owner and other users with access.

Recommendations Update to version 0.9.3.

Exploit

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-07455

CVE-2026-45316

GHSA-JX2X-J75F-XQ3J

Affected Products

Open-Webui

References · 9

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-jx2x-j75f-xq3j · Exploit
• https://bdu.fstec.ru/vul/2026-07455 · Security Note
• https://osv.dev/vulnerability/GHSA-jx2x-j75f-xq3j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45316 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/releases/tag/v0.9.3 · Note
• https://twitter.com/CVEnew/status/2055457490750329348 · Twitter Post
• https://t.me/CVEtracker/53978 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2055462167172784180 · Twitter Post