Vulnerability intelligence

CVE-2026-45386

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, Pin/Unpin is a write operation (modifies the message's is_pinned , pinned_by, pinned_at fields), but in standard channels it only checks read permission, allowing users with read-only access to pin/unpin any message. This vulnerability is fixed in 0.9.5.

CVSS Score

4.3

Medium

EPSS — Exploit Probability

0.3%

Riskier than 19% of all CVEs · checked 2026-10-09

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered Aug 26, 2026 · latest Aug 26, 2026

Coverage timeline

AI driven software surge fuels record Q2 2026 vulnerability spike
securelist.com · Aug 26, 2026