Skip to content
OpenAdvisories

Vendor

open-webui

175 known vulnerabilities.

Products

open-webui 167 open-webui/open-webui 8
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.5
    CVE-2026-45316 Public exploit

    Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the POST /api/v1/notes/{id}/pin endpoint performs a write operation (toggling the is_pinned field) but only checks for read permission. Users wi…

    open-webui open-webui open-webui PyPI