CVE-2026-54006

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6

Description An authorization bypass exists in the calendar event update process. The endpoint '/api/v1/calendars/events/{event id}/update' validates that the user has write access to the calendar where the event is currently located, but it fails to validate the destination calendar id provided in the request body. Consequently, the model layer persists the new calendar id without verification.

This allows a user with a regular account to create an event in their own calendar and then move it into any other user's calendar, provided they know the target calendar's ID. This bypasses the authorization checks normally performed during event creation. This issue is present in default configurations where ENABLE CALENDAR and USER PERMISSIONS FEATURES CALENDAR are set to True.

Potential impacts include escalating read-only access to write access on shared calendars, performing phishing or social engineering by injecting events into a victim's private calendar, and conducting calendar spam or denial-of-service attacks.

Recommendations Update to version 0.9.6. As a temporary mitigation, consider disabling the calendar features by setting ENABLE CALENDAR or USER PERMISSIONS FEATURES CALENDAR to False in the configuration.