CVE-2026-87012

Open WebUI, a widely used self-hosted AI platform, fails to validate the type of the calendar event meta.alert_minutes value in backend/open_webui/models/calendar.py in versions 0.9.0 through 0.11.0. An authenticated user holding the calendar permission can store a non-numeric alert_minutes value that raises an exception during the shared upcoming-event scheduler's numeric comparison, aborting the instance-wide alert pass. The practical gain is a low-severity availability impact: reminder notifications are silently suppressed for every user on the instance for as long as the malformed event remains in the lookahead window. Affected deployments are any Open WebUI instances from 0.9.0 up to (but not including) 0.11.1 that have the calendar feature enabled. Exploitation status: no known attacks in the wild; EPSS is very low (0.3% in 30 days), and the only public reference is the upstream GitHub security advisory (GHSA-v39v-59xw-j98g).

What to do: Upgrade Open WebUI to version 0.11.1 or later, which validates the alert_minutes type before storing and comparing it. Audit existing calendar events for non-numeric alert_minutes values and remove or correct them so reminders resume. As a hardening measure, restrict the calendar permission to trusted user groups and monitor scheduler logs for recurring exceptions that indicate a malformed event is aborting the alert pass.