THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-v39v-59xw-j98g (medium) — Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

[GHSA] GHSA-v39v-59xw-j98g (medium) — Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

highgithub_advisoriesPublished 2026-09-10

GHSA-v39v-59xw-j98g Severity: medium CVE: CVE-2026-87012

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

# Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

## Summary

Calendar events carry a free-form `meta` object that is stored exactly as submitted, with no validation of the values insi

Indicators of compromise

CVE-2026-87012cve
ghcr.iodomain

Original source: https://github.com/advisories/GHSA-v39v-59xw-j98g