SA-26-607 Medium

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI

Severity
Medium, CVSS 4.3
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Record
CVE-2026-87013
Affects
Open WebUI
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
September 9, 2026
Source last modified
September 15, 2026

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read did not track visited folder identifiers. An authenticated user could persist a parent cycle and start a request that consumed CPU and memory indefinitely, with the condition remaining stored until repaired. This issue is fixed in version 0.11.1.

Description quoted from the NVD record.

Sources

MORE ADVISORIES

See all