What is CVE-2026-87012?

CVE-2026-87012 is a medium-severity vulnerability in Open-Webui, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 4.3/10. Published 2026-09-09.

How severe is CVE-2026-87012?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Open-Webui

CVE-2026-87012

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar event meta.alert_minutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An authenticated user with the calendar permission could store a non-numeric alert_minutes value that raised an exception and aborted the instance-wide alert pass, suppressing all users' reminders while the event remained in the lookahead window. This issue is fixed in version 0.11.1.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.

Affected products

Open-webui — versions >= 0.9.0, < 0.11.1

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-87012?: CVE-2026-87012 is a medium-severity vulnerability in Open-Webui, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 4.3/10. Published 2026-09-09.
How severe is CVE-2026-87012?: Medium severity. CVSS v3 base score is 4.3 out of 10.