CVE-2026-54006

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/v1/calendars/events/{event_id}/update validates that the caller has write access to the calendar the event currently belongs to, but does not validate the destination calendar_id supplied in the request body. The model layer then persists the new calendar_id unconditionally. A regular user-role account can therefore create an event in their own calendar and immediately move it into any other user's calendar whose ID they know — bypassing the authorization check that create_event correctly performs. This vulnerability is fixed in 0.9.6.

Traduire en français

Produits concernés

• open-webui
• Openwebui open webui

Scores CVSS

Faiblesses (CWE)

• CWE-639

Références

• https://github.com/open-webui/open-webui/security/advisories/GHSA-f3g7-59qc-pqg6 ExploitVendor Advisory
• https://github.com/open-webui/open-webui/security/advisories/GHSA-f3g7-59qc-pqg6 ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories