The vulnerability resides in Open WebUI’s automation recurrence‑rule validator. Users authorized to create automations can submit rules that are parsed more strictly by the guard than by the calendar library that executes them. Such rules—whitespace‑folded, lowercased frequencies, or omitted RRULE prefixes—trigger per‑second synchronous execution and block the shared event loop for minutes on each request and on every scheduler poll, leading to service disruption.

Open WebUI versions 0.11.0 through 0.11.3 are affected. Any user with permission to create or alter automations on those releases can trigger the denial of service. No other product releases are known to be impacted.

The CVSS score of 7.1 indicates high severity. EPSS data is minimal and the vulnerability is not listed in the CISA KEV catalog, so exploitation likelihood remains uncertain. An attacker must have at least the ability to create or modify automations, which can be achieved by a valid authenticated user or by exploiting an existing account. Once the malformed rule is submitted, the event loop is blocked for minutes per request, effectively denying service to all users on the instance.