CVE-2026-54006

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/v1/calendars/events/{event_id}/update validates that the caller has write access to the calendar the event currently belongs to, but does not validate the destination calendar_id supplied in the request body. The model layer then persists the new calendar_id unconditionally. A regular user-role account can therefore create an event in their own calendar and immediately move it into any other user's calendar whose ID they know — bypassing the authorization check that create_event correctly performs. This vulnerability is fixed in 0.9.6.

• CWE-639

• https://github.com/open-webui/open-webui/security/advisories/GHSA-f3g7-59qc-pqg6Exploit, Vendor Advisory
• https://github.com/open-webui/open-webui/security/advisories/GHSA-f3g7-59qc-pqg6Exploit, Vendor Advisory

Published

Jun 23, 2026

Last Modified

Jun 25, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54000osquery is a SQL powered operating system instrumentation, m…7
• CVE-2026-54001osquery is a SQL powered operating system instrumentation, m…7
• CVE-2026-54002Kirby is an open-source content management system. Prior to …8.5
• CVE-2026-54003Kirby is an open-source content management system. Prior to …9.1
• CVE-2026-54004Kirby is an open-source content management system. Prior to …6.3
• CVE-2026-54005Kirby is an open-source content management system. Prior to …7.1
• CVE-2026-54007Open WebUI is a self-hosted artificial intelligence platform…6.5
• CVE-2026-54008Open WebUI is a self-hosted artificial intelligence platform…8.5
• CVE-2026-54009Open WebUI is a self-hosted artificial intelligence platform…6.5
• CVE-2026-5401AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to…5.5
• CVE-2026-54010Open WebUI is a self-hosted artificial intelligence platform…8.3
• CVE-2026-54011Open WebUI is a self-hosted artificial intelligence platform…5.4