CVE-2026-87012

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0

Description An issue exists in the calendar event model within backend/open webui/models/calendar.py where the meta.alert minutes value is stored without type validation. Because the shared upcoming-event scheduler compares this value numerically in a single pass for all users, an authenticated user with calendar permissions can store a non-numeric value in the meta.alert minutes variable. This action triggers an exception that aborts the instance-wide alert process, suppressing calendar reminders for all users on the platform as long as the malicious event remains within the scheduler's one-hour lookahead window. This results in a loss of availability for the calendar alert feature across the entire instance, although other functions like chat, timers, and the HTTP API remain operational.

Recommendations Update to version 0.11.1. As a temporary mitigation, restrict the calendar feature permission from regular users or disable the calendar functionality entirely via the ENABLE CALENDAR or calendar.enable configuration.