Medium severity4.3NVD Advisory· Published Sep 9, 2026· Updated Sep 15, 2026
CVE-2026-87012
CVE-2026-87012
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar event meta.alert_minutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An authenticated user with the calendar permission could store a non-numeric alert_minutes value that raised an exception and aborted the instance-wide alert pass, suppressing all users' reminders while the event remained in the lookahead window. This issue is fixed in version 0.11.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
open-webuiPyPI | >= 0.9.0, < 0.11.1 | 0.11.1 |
Affected products
3(expand)+ 2 more
- (no CPE)
- cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*range: >=0.9.0,<0.11.1
- (no CPE)range: 0.9.0 - 0.11.0
Patches
Vulnerability mechanics
References
6- github.com/open-webui/open-webui/commit/abc69000b33b4894fbd97fc2c962139cf9a8d784nvdPatchWEB
- github.com/open-webui/open-webui/pull/28790nvdIssue TrackingPatchWEB
- github.com/open-webui/open-webui/security/advisories/GHSA-v39v-59xw-j98gnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-v39v-59xw-j98gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-87012ghsaADVISORY
- github.com/open-webui/open-webui/releases/tag/v0.11.1nvdRelease NotesWEB
News mentions
1- Open WebUI: 18 Vulnerabilities Disclosed, Patch Released in Version 0.11.1Vypr Intelligence · Sep 10, 2026