Nayakchinmohan

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.9.6 **Description** An authorization bypass exists in the calendar event update process. The endpoint '/api/v1/calendars/events/{event id}/update' validates that the user has write access to the calendar where the event is currently located, but it fails to validate the destination `calendar id` provided in the request body. Consequently, the model layer persists the new `calendar id` without verification. This allows a user with a regular account to create an event in their own calendar and then move it into any other user's calendar, provided they know the target calendar's ID. This bypasses the authorization checks normally performed during event creation. This issue is present in default configurations where `ENABLE CALENDAR` and `USER PERMISSIONS FEATURES CALENDAR` are set to `True`. Potential impacts include escalating read-only access to write access on shared calendars, performing phishing or social engineering by injecting events into a victim's private calendar, and conducting calendar spam or denial-of-service attacks. **Recommendations** Update to version 0.9.6. As a temporary mitigation, consider disabling the calendar features by setting `ENABLE CALENDAR` or `USER PERMISSIONS FEATURES CALENDAR` to `False` in the configuration.