CVE-2026-45316: Open WebUI Auth Bypass Vulnerability

CVE-2026-45316 Overview

CVE-2026-45316 is an authorization flaw in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The vulnerability affects the POST /api/v1/notes/{id}/pin endpoint in versions prior to 0.9.3. The endpoint performs a write operation by toggling the is_pinned field but only verifies read permission. Users with read-only access to a shared note can pin or unpin it, modifying state without holding write permission. The issue is classified under CWE-863: Incorrect Authorization and is resolved in version 0.9.3.

Critical Impact
Read-only collaborators on shared notes can perform state-modifying pin/unpin actions, undermining the integrity of access control on shared resources.

Affected Products

Open WebUI versions prior to 0.9.3
Self-hosted Open WebUI deployments with shared notes enabled
Multi-user Open WebUI instances using read-only sharing

Discovery Timeline

2026-05-15 - CVE-2026-45316 published to the National Vulnerability Database (NVD)
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45316

Vulnerability Analysis

The vulnerability lies in how Open WebUI enforces permission boundaries on note sharing. Open WebUI supports collaboration on notes through a sharing model that distinguishes between read and write access. The POST /api/v1/notes/{id}/pin endpoint modifies the is_pinned attribute of a note, which is persistent state stored on the server. Even though pinning constitutes a write action, the endpoint validates only that the caller has read access to the target note. Any user granted read-only access can therefore alter the pin state of a shared note, contradicting the documented permission model. The flaw violates integrity expectations for shared resources but does not expose confidential data or disrupt availability.

Root Cause

The root cause is a missing authorization check on a state-modifying endpoint. The handler uses the read-permission predicate when it should require the write-permission predicate. This is a classic [CWE-863] incorrect authorization defect where the access control logic and the operation semantics are misaligned. The pin operation was likely treated as a low-impact UI preference, yet it is persisted and visible to all collaborators on the note.

Attack Vector

Exploitation requires an authenticated account with read-only access to a shared note. The attacker issues a POST request to /api/v1/notes/{id}/pin against a note they can view but should not modify. The server toggles is_pinned and persists the change. No user interaction beyond the attacker's own session is required to perform the action, though impact remains limited to the integrity of the pin attribute. No verified exploit code is publicly available; refer to the GitHub Security Advisory GHSA-jx2x-j75f-xq3j for vendor details.

Detection Methods for CVE-2026-45316

Indicators of Compromise

Unexpected changes to the is_pinned field on shared notes in the Open WebUI database
HTTP POST requests to /api/v1/notes/{id}/pin originating from accounts holding only read permission on the targeted note
User reports of notes being pinned or unpinned without the owner's action

Detection Strategies

Review Open WebUI application logs for POST /api/v1/notes/{id}/pin calls and correlate the caller's permission level against the note's sharing configuration
Implement audit logging that records the actor, target note ID, and resulting is_pinned value for every pin toggle
Compare current Open WebUI version against 0.9.3 across all self-hosted instances

Monitoring Recommendations

Forward Open WebUI access logs to a centralized log platform for query and alerting on pin endpoint activity
Alert on any pin endpoint invocation by users whose effective access on the note is read-only
Track repeated pin/unpin toggles on the same note as a signal of abuse or scripted activity

How to Mitigate CVE-2026-45316

Immediate Actions Required

Upgrade all Open WebUI deployments to version 0.9.3 or later
Inventory shared notes and validate that current pin states reflect owner intent
Audit user roles and revoke unnecessary read access to sensitive shared notes until patching completes

Patch Information

Open WebUI version 0.9.3 fixes the authorization check on the POST /api/v1/notes/{id}/pin endpoint so that pin and unpin operations require write permission. Patch details are documented in the GitHub Security Advisory GHSA-jx2x-j75f-xq3j. Administrators should apply the upgrade following the project's standard deployment procedure for their environment, whether container-based or source install.

Workarounds

Restrict note sharing to trusted users until the upgrade to 0.9.3 is complete
Disable shared note functionality where feasible by limiting collaboration to single-owner notes
Place Open WebUI behind a reverse proxy that can block POST /api/v1/notes/{id}/pin requests from accounts identified as read-only collaborators

bash

# Example: upgrade Open WebUI container deployment to the patched version
docker pull ghcr.io/open-webui/open-webui:0.9.3
docker stop open-webui && docker rm open-webui
docker run -d \
  --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.9.3