CVE-2026-54006 Overview
CVE-2026-54006 is an authorization bypass vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw exists in the POST /api/v1/calendars/events/{event_id}/update endpoint in versions prior to 0.9.6. The endpoint verifies that the caller has write access to the calendar the event currently belongs to, but it does not validate the destination calendar_id supplied in the request body. A regular user-role account can create an event in their own calendar and move it into any other user's calendar whose ID they know. This vulnerability is classified under [CWE-639] Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated low-privilege users can write events into arbitrary users' calendars, undermining tenant isolation and integrity of calendar data.
Affected Products
- Open WebUI versions prior to 0.9.6
- Self-hosted Open WebUI deployments exposing the calendar API
- Multi-user Open WebUI instances with the default user role enabled
Discovery Timeline
- 2026-06-23 - CVE-2026-54006 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-54006
Vulnerability Analysis
The vulnerability resides in the calendar event update handler. When a client issues POST /api/v1/calendars/events/{event_id}/update, the server checks that the caller holds write permission on the calendar currently owning the event. The handler does not perform an equivalent check on the calendar_id field within the request body, which represents the destination calendar after the update.
The model layer then persists the supplied calendar_id unconditionally. The result is that an authenticated user can move an event into any calendar whose identifier they obtain or guess. The create_event path performs the correct authorization check, but the update path bypasses this control, producing an inconsistent authorization model across operations on the same resource.
Root Cause
The root cause is a missing object-level authorization check on a user-controlled key. The destination calendar_id in the update payload acts as an Insecure Direct Object Reference. The server trusts the client-provided identifier without verifying that the authenticated principal has write access to the target calendar.
Attack Vector
Exploitation requires only a low-privilege authenticated account and network access to the Open WebUI API. An attacker creates an event in a calendar they own. They then submit an update request that sets calendar_id to the identifier of a victim calendar. The server moves the event into the victim's calendar without further authorization. The attack succeeds without user interaction from the victim.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-f3g7-59qc-pqg6 for technical details.
Detection Methods for CVE-2026-54006
Indicators of Compromise
- Calendar events appearing in a user's calendar that were not created by that user or by an administrator.
- Application logs showing POST /api/v1/calendars/events/{event_id}/update requests where the request body calendar_id does not match the calendar_id stored on the event prior to the request.
- Bursts of update requests from a single low-privilege account targeting events across multiple calendar_id values.
Detection Strategies
- Audit Open WebUI application logs for update calls that change the calendar_id of an event to a calendar not owned by the requesting user.
- Compare event ownership and calendar ownership in the database to surface events whose creator does not have write access to the containing calendar.
- Alert on accounts issuing update requests against many distinct event_id values across multiple calendars in a short interval.
Monitoring Recommendations
- Forward Open WebUI access and application logs to a centralized log platform with retention sufficient for incident review.
- Track HTTP 200 responses on the calendar update endpoint and correlate with the authenticated user and resulting calendar_id.
- Review calendar contents on multi-user instances periodically until all hosts are upgraded to 0.9.6.
How to Mitigate CVE-2026-54006
Immediate Actions Required
- Upgrade all Open WebUI instances to version 0.9.6 or later, which contains the authorization fix.
- Inventory existing calendar events and remove unauthorized entries created through the update endpoint.
- Rotate or restrict API tokens issued to low-trust users on unpatched instances until the upgrade completes.
Patch Information
The vulnerability is fixed in Open WebUI 0.9.6. The vendor advisory and fix details are published in the GitHub Security Advisory GHSA-f3g7-59qc-pqg6. The fix adds authorization validation on the destination calendar_id provided in the update request body so the server enforces write access on both the source and destination calendars.
Workarounds
- Restrict access to the Open WebUI API to trusted users only until the patched version is deployed.
- Place the application behind a reverse proxy that blocks or audits calls to POST /api/v1/calendars/events/{event_id}/update from non-administrative accounts.
- Disable the user role or limit account creation on multi-tenant deployments until the upgrade is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
