CVE-2026-87012: Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/openwebui/models/calendar.py stored the calendar event meta.alertminutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An authenticated user with the calendar permission could store a non-numeric alertminutes value that raised an exception and aborted the instance-wide alert pass, suppressing all users' reminders while the event remained in the lookahead window. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
backend/open_webui/models/calendar.pyto a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Which users could trigger the disruption?
An attacker must be authenticated and have the calendar permission. The issue affects the shared upcoming-event scheduler, so a successful trigger can suppress reminders for all users on the instance.
What versions should be prioritized for remediation?
Open WebUI versions from 0.9.0 until the 0.11.1 fix are affected. Upgrade to version 0.11.1, which includes type validation for the calendar alert value.
What must an attacker do to exploit this issue?
They need to create or modify a calendar event so that its alert_minutes metadata contains a non-numeric value. When the scheduler processes that event, the resulting exception aborts the instance-wide alert pass while the event remains in the lookahead window.