# Open WebUI v0.12.0 — Release & Upgrade Intelligence
- **Product:** Open WebUI (https://openwebui.com)
- **Version:** v0.12.0
- **Released:** Oct 10, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/open-webui/updates/v0.12.0/

## Executive Summary (TL;DR)
Open WebUI v0.12.0. Source highlight: ☎️ **Realtime voice calls.** Administrators can now switch Call mode in the Voice calls section of Audio settings from Standard to Realtime, so Voice mode talks through an OpenAI Realtime voice model (gpt-realtime-2.1-mini with the Marin voice by default) that handles small talk itself and hands rea

## New Features
- ☎️ **Realtime voice calls.** Administrators can now switch Call mode in the Voice calls section of Audio settings from Standard to Realtime, so Voice mode talks through an OpenAI Realtime voice model (gpt-realtime-2.1-mini with the Marin voice by default) that handles small talk itself and hands real questions and tasks to the chat's selected model, with its conversation history and tools, before speaking the answer while the full reply appears in the chat. Approvals and questions from tools sti
- 🕺 **Animated avatars in Realtime voice calls.** A model can now show a 3D character instead of the voice orb during Realtime calls: in the model editor, upload a rigged VRM avatar of up to 25 MiB, preview it, optionally give it VRMA clips of up to 10 MiB for its idle, listening and speaking states, and add up to 16 named gestures with a description, which the voice model plays on its own when the conversation fits or when asked, such as a wave or a clap, while the avatar's mouth follows the spok
- 🔏 **Two-factor sign-in.** Administrators can require an authenticator app for every user under Admin Settings > Authentication, or with "ENABLE_MFA", so users set one up from a QR code on their next sign-in, get ten single-use recovery codes, and can later replace their authenticator or create new recovery codes in their account settings; OAuth and trusted-header sign-ins can be let through without it with "MFA_ALLOW_OAUTH_BYPASS" and "MFA_ALLOW_TRUSTED_HEADER_BYPASS", and the "open-webui mfa re
- 👫 **Replying in shared chats.** When sharing a chat with people or groups, or sharing a folder, the new Sharing mode setting can be switched from Clone only to Allow replies, so everyone it is shared with can keep writing in the same conversation instead of cloning it. Each message shows the name and profile picture of who sent it, with other people's messages on the left in bubble view, replies stream live to everyone with the chat open, a line above the input shows who is typing, people can on
- 🕹️ **Model controls.** Anyone who can edit a model can now add named controls to it in the model editor, such as a Thinking control whose Low, Medium and High options each set the reasoning effort, where every option can carry its own custom parameters and one can be marked as the default, shown either as a menu or as a slider that runs from the first option to the last; people with the Allow Chat Controls and Allow Chat Params permissions then pick an option from a knobs button next to the mode
- 🧠 **Compaction during long tool runs.** With context compaction on and native function calling, a reply that runs many tool calls in a row is now compacted between tool rounds once its context passes the token threshold, keeping each tool call together with its results and giving the summary the tool names and arguments, where compaction only ran before the reply started and a long tool run could grow past the model's context. Commit, #27599

## Bug Fixes
- 🛡️ **Security Advisory**: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
- 🚷 **Revoked access ends live updates.** Removing someone's access to a shared channel or a note, or deleting it, now also stops the live messages and edits their open sessions were still receiving from it. Commit
- 📄 **Docling file names.** A document sent to a Docling server for extraction now carries only its file name, where it previously revealed the full path the file is stored under on the server. #30357, #30352
- 🔒 **Share links of deleted folders.** Deleting a folder together with its chats now also removes those chats' share links, where the shared conversations stayed reachable through them. #31306, #31305
- 🙈 **Admin chat access setting enforced everywhere.** With "ENABLE_ADMIN_CHAT_ACCESS" turned off, administrators can no longer read, change, share, clone, delete, message into or attach other users' chats through direct API requests, where only opening them was refused. #31416, #31413
- 👥 **Direct message members.** The person who started a direct message can no longer add or remove people through the API, where someone added this way could read the whole earlier conversation and the original pair ended up in a second, empty direct message. #31575, #31570