CVE-2026-45386

Katalog CVE

CVSS 4.3 · Medium EPSS 0,29%

Kerentanan Authorization Bypass Through User-Controlled Key pada openwebui open webui. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, Pin/Unpin is a write operation (modifies the message's is_pinned , pinned_by, pinned_at fields), but in standard channels it only checks read permission, allowing users with read-only access to pin/unpin any message. This vulnerability is fixed in 0.9.5.

Rincian

Terbit di NVD

15 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/security/advisories/GHSA-5gc6-xhv4-2wg6 exploit · mitigasi · advisory vendor