CVE-2026-45386

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, Pin/Unpin is a write operation (modifies the message's is_pinned , pinned_by, pinned_at fields), but in standard channels it only checks read permission, allowing users with read-only access to pin/unpin any message. This vulnerability is fixed in 0.9.5.

• CWE-639

• https://github.com/open-webui/open-webui/security/advisories/GHSA-5gc6-xhv4-2wg6Exploit, Mitigation, Vendor Advisory
• https://github.com/open-webui/open-webui/security/advisories/GHSA-5gc6-xhv4-2wg6Exploit, Mitigation, Vendor Advisory

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4538A vulnerability was identified in PyTorch 2.10.0. The affect…7.8
• CVE-2026-45380bit7z is a cross-platform C++ static library that allows the…3.6
• CVE-2026-45382libde265 is an open source implementation of the h.265 video…6.9
• CVE-2026-45383libde265 is an open source implementation of the h.265 video…6.9
• CVE-2026-45384bit7z is a cross-platform C++ static library that allows the…6.1
• CVE-2026-45385Open WebUI is a self-hosted artificial intelligence platform…4.3
• CVE-2026-45387Open WebUI is a self-hosted artificial intelligence platform…4.3
• CVE-2026-45388In OCaml-TLS before 2.1.0, the client implementation does in…9.1
• CVE-2026-45389In OCaml-TLS before 2.1.0, the server implementation does in…7.4
• CVE-2026-4539A security flaw has been discovered in pygments up to 2.19.2…3.3
• CVE-2026-45390In OCaml-tar before 3.4.0, a crafted archive with ../ path s…9.1
• CVE-2026-45391A command injection vulnerability in Cribl Edge for Linux ve…8.5