Calendar ID Authorization Bypass in Open WebUI

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-54006 is an Insecure Direct Object Reference (IDOR) vulnerability in the Open WebUI application, affecting versions 0.9.5 and earlier.

The vulnerability occurs because the update endpoint for calendar events validates write access to the source calendar but does not validate the destination calendar ID supplied in the request body.

This allows a regular user to create an event in their own calendar and then move it into another user's calendar by supplying the victim's calendar ID, bypassing authorization checks.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to unauthorized modification of other users' calendars.

• Phishing attacks by placing malicious events in victim calendars.
• Calendar spam that disrupts normal calendar usage.
• Denial-of-service conditions by overwhelming calendars with unwanted events.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring API requests to the endpoint POST /api/v1/calendars/events/{event_id}/update and checking if events are being moved to calendars without proper authorization.

Specifically, look for requests where a user moves an event from their own calendar to another user's calendar by supplying a different calendar_id in the request body.

Commands or methods to detect this might include:

• Using network traffic analysis tools (e.g., tcpdump, Wireshark) to capture and inspect POST requests to the vulnerable endpoint.
• Querying application logs for update requests to /api/v1/calendars/events/*/update where the calendar_id in the request body differs from the original event's calendar.
• Using curl or similar tools to test the endpoint with crafted requests to verify if unauthorized calendar_id changes are accepted.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the Open WebUI application to version 0.9.6 or later, where the issue is fixed.

Until the upgrade can be performed, consider disabling calendar features or restricting access to the calendar event update API endpoint to trusted users only.

Additionally, monitor for suspicious activity involving calendar event updates that move events between users without proper authorization.

Useful 0 Not Useful 0