Open WebUI's /api/v1/notes/{id}/pin endpoint toggles the is_pinned field of a note. Prior to version 0.9.3 this endpoint performs a write operation but only verifies that the caller has read permission. Consequently users who have been granted read-only access to shared notes can modify the pinned state of a note, an operation that should require write permission. This represents a privilege-escalation weakness and is identified as CWE-863.

The affected application is Open WebUI, a self-hosted AI platform. All releases prior to 0.9.3 are vulnerable. The issue is tied to the POST /api/v1/notes/{id}/pin API endpoint.

The CVSS score of 3.5 reflects the low impact of a state-change. The EPSS score is not available, so there is no data showing current exploitation likelihood, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves an authenticated user executing an API request to pin or unpin a note; no additional privileges or network access are required beyond read-only rights. Exploitation yields only a modification of a note’s pinned status, but any downstream logic that treats pinned notes differently could cause subtle data-flow or availability effects. Overall the risk is considered low, but the privilege escalation nature warrants prompt correction.