CVE-2026-87012

Analyzed Analyzed - Analysis Complete

Type Confusion in Open WebUI Calendar Event Alerts

Publication date: 2026-09-09

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar event meta.alert_minutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An authenticated user with the calendar permission could store a non-numeric alert_minutes value that raised an exception and aborted the instance-wide alert pass, suppressing all users' reminders while the event remained in the lookahead window. This issue is fixed in version 0.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-15

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-87012

Affected Vendors & Products

Vendor	Product	Version / Range
openwebui	open_webui	From 0.9.0 (inc) to 0.11.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CWE-1287	The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

Executive Summary

This vulnerability in Open WebUI allows an authenticated user with calendar permissions to store a non-numeric value in the alert_minutes field. This causes an exception during the alert pass, suppressing all users' reminders while the event remains in the lookahead window.

Detection Guidance

Check Open WebUI versions between 0.9.0 and 0.11.1. Inspect calendar event meta.alert_minutes values for non-numeric entries. Review logs for exceptions during alert processing.

Impact Analysis

If exploited, this vulnerability could prevent you and other users from receiving important calendar reminders and alerts. It disrupts scheduled notifications system-wide until the problematic event is removed or the system is restarted.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a denial-of-service issue in Open WebUI that disrupts calendar alert functionality for users but does not involve unauthorized data access, processing violations, or breaches of protected health or personal information.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.1 or later. Remove or correct any non-numeric alert_minutes values in calendar events. Restart the service to apply changes.

Hi! I’m here to help you understand CVE-2026-87012. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70