{
  "affected": [
    {
      "affectedData": [
        {
          "product": "open-webui",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.10.0, \u003c 0.11.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-history deletion helper in backend/open_webui/models/chats.py to follow childrenIds without recording visited message identifiers. An authenticated user could store a cyclic chat tree and delete a message, causing a synchronous infinite loop on the server request loop that blocked every user\u0027s requests until the process was killed. This issue is fixed in version 0.11.1."
    }
  ],
  "id": "CVE-2026-88000",
  "lastModified": "2026-09-10T14:50:07.813",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-09T22:18:48.777",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-webui/open-webui/commit/b933292d63d12be3fd1416fe55519ddc7aa336bc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-webui/open-webui/pull/28035"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3cgp-3cqx-j8w2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.10.0"
            },
            {
              "fixed": "0.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-88000"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T23:54:22Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\nChat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat\u0027s new current message walked down the `childrenIds` links without recording where it had already been. Any account with the default `user` role could store a chat whose messages list each other as children, then delete a message from it, and the walk would run forever. That walk runs on the server\u0027s request loop, so it blocks every other user\u0027s requests until the process is killed.\n\n## Preconditions\nOne account with the default `user` role. No administrator rights, no additional permissions, no configuration change and no non-default setting: creating and deleting chats is available to every user out of the box. The attack runs entirely against the attacker\u0027s own chat, so no knowledge of any other user\u0027s data is needed. Versions before 0.10.0 are unaffected because neither the message-deletion endpoint nor the affected code existed.\n\n## Impact\nThe walk is synchronous and runs on the asyncio event loop, so while it spins, every request from every user is blocked, including unauthenticated `/health` and administrator endpoints. External health checks and orchestrator liveness probes fail alongside the UI. This is a pure CPU pin with no list growth, so a worker consumes one full core with flat memory and has to be killed rather than being reclaimed by an out-of-memory kill. The work is not cancelled when the client disconnects, so a single fire-and-forget request is enough and the attacker can disconnect immediately. The malformed chat stays in the database, so the condition re-arms on the next deletion attempt against that chat. No data is disclosed, altered or deleted.\n\n## Fix\nFixed in 0.11.1 by https://github.com/open-webui/open-webui/commit/b933292d63d12be3fd1416fe55519ddc7aa336bc. The walk now records the ids it has already passed through, so it terminates after at most one step per stored message whatever the message contents are. Upgrading fully resolves the issue, including for chats stored while the deployment was on an affected version, which become harmless once the walk terminates.\n\n## Root cause\nAffected component: the chat-history message deletion helper in `backend/open_webui/models/chats.py`, reached from `DELETE /api/v1/chats/{id}/messages/{message_id}`. Affected setup: all builds from 0.10.0 up to and including 0.11.0.\n\nResolving the chat\u0027s new current message after a deletion means descending to the deepest remaining child, and that descent had no notion of where it had already been, so two messages naming each other as children sent it back and forth indefinitely. The write path does not validate the structure of a chat\u0027s history, and the child-link rebuild that runs on other write paths does not apply when a chat is created, so a history whose `childrenIds` form a cycle was persisted exactly as submitted.\n\n## Proof of concept\nAs a default-role user on a running instance, store one chat of roughly 300 bytes whose messages reference each other as children:\n\n```json\n{\"chat\":{\"title\":\"poc\",\"history\":{\"currentId\":\"C\",\"messages\":{\n  \"A\":{\"id\":\"A\",\"parentId\":null,\"role\":\"user\",\"content\":\"a\",\"childrenIds\":[\"B\",\"C\"],\"timestamp\":1},\n  \"B\":{\"id\":\"B\",\"parentId\":\"A\",\"role\":\"assistant\",\"content\":\"b\",\"childrenIds\":[\"A\"],\"timestamp\":2},\n  \"C\":{\"id\":\"C\",\"parentId\":\"A\",\"role\":\"user\",\"content\":\"c\",\"childrenIds\":[],\"timestamp\":3}}}}}\n```\n\n`POST /api/v1/chats/new` stores it verbatim, with the child links unchanged. A single `DELETE /api/v1/chats/{id}/messages/C` as the same user then never returns:\n\n```\n   unauthenticated GET /health -\u003e HTTP 000 after 10.007s\n   DELETE -\u003e HTTP 000 after 20.007s\n```\n\nSampled during the hang, the worker had consumed 42.9 seconds of CPU on one fully occupied core with flat resident memory, and unauthenticated `GET /health` timed out for as long as the process lived, including after the attacker\u0027s connection closed.\n\nOn 0.11.1 the same payload returns HTTP 200 in 0.011s, `/health` stays available throughout, and deleting a middle message from a well-formed four-message chain still resolves the current message correctly.\n\n## Credits\n@Classic298, who found the unguarded descent through the chat\u0027s child links, demonstrated the resulting server-wide outage end to end against a live instance, and supplied the fix.",
  "id": "GHSA-3cgp-3cqx-j8w2",
  "modified": "2026-09-09T23:54:22Z",
  "published": "2026-09-09T23:54:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3cgp-3cqx-j8w2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/pull/28035"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/b933292d63d12be3fd1416fe55519ddc7aa336bc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui",
        "purl": "pkg:pypi/open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.10.0"
            },
            {
              "fixed": "0.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.0",
        "0.10.1",
        "0.10.2",
        "0.11.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-88000",
    "GHSA-3cgp-3cqx-j8w2"
  ],
  "details": "## Summary\nChat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat\u0027s new current message walked down the `childrenIds` links without recording where it had already been. Any account with the default `user` role could store a chat whose messages list each other as children, then delete a message from it, and the walk would run forever. That walk runs on the server\u0027s request loop, so it blocks every other user\u0027s requests until the process is killed.\n\n## Preconditions\nOne account with the default `user` role. No administrator rights, no additional permissions, no configuration change and no non-default setting: creating and deleting chats is available to every user out of the box. The attack runs entirely against the attacker\u0027s own chat, so no knowledge of any other user\u0027s data is needed. Versions before 0.10.0 are unaffected because neither the message-deletion endpoint nor the affected code existed.\n\n## Impact\nThe walk is synchronous and runs on the asyncio event loop, so while it spins, every request from every user is blocked, including unauthenticated `/health` and administrator endpoints. External health checks and orchestrator liveness probes fail alongside the UI. This is a pure CPU pin with no list growth, so a worker consumes one full core with flat memory and has to be killed rather than being reclaimed by an out-of-memory kill. The work is not cancelled when the client disconnects, so a single fire-and-forget request is enough and the attacker can disconnect immediately. The malformed chat stays in the database, so the condition re-arms on the next deletion attempt against that chat. No data is disclosed, altered or deleted.\n\n## Fix\nFixed in 0.11.1 by https://github.com/open-webui/open-webui/commit/b933292d63d12be3fd1416fe55519ddc7aa336bc. The walk now records the ids it has already passed through, so it terminates after at most one step per stored message whatever the message contents are. Upgrading fully resolves the issue, including for chats stored while the deployment was on an affected version, which become harmless once the walk terminates.\n\n## Root cause\nAffected component: the chat-history message deletion helper in `backend/open_webui/models/chats.py`, reached from `DELETE /api/v1/chats/{id}/messages/{message_id}`. Affected setup: all builds from 0.10.0 up to and including 0.11.0.\n\nResolving the chat\u0027s new current message after a deletion means descending to the deepest remaining child, and that descent had no notion of where it had already been, so two messages naming each other as children sent it back and forth indefinitely. The write path does not validate the structure of a chat\u0027s history, and the child-link rebuild that runs on other write paths does not apply when a chat is created, so a history whose `childrenIds` form a cycle was persisted exactly as submitted.\n\n## Proof of concept\nAs a default-role user on a running instance, store one chat of roughly 300 bytes whose messages reference each other as children:\n\n```json\n{\"chat\":{\"title\":\"poc\",\"history\":{\"currentId\":\"C\",\"messages\":{\n  \"A\":{\"id\":\"A\",\"parentId\":null,\"role\":\"user\",\"content\":\"a\",\"childrenIds\":[\"B\",\"C\"],\"timestamp\":1},\n  \"B\":{\"id\":\"B\",\"parentId\":\"A\",\"role\":\"assistant\",\"content\":\"b\",\"childrenIds\":[\"A\"],\"timestamp\":2},\n  \"C\":{\"id\":\"C\",\"parentId\":\"A\",\"role\":\"user\",\"content\":\"c\",\"childrenIds\":[],\"timestamp\":3}}}}}\n```\n\n`POST /api/v1/chats/new` stores it verbatim, with the child links unchanged. A single `DELETE /api/v1/chats/{id}/messages/C` as the same user then never returns:\n\n```\n   unauthenticated GET /health -\u003e HTTP 000 after 10.007s\n   DELETE -\u003e HTTP 000 after 20.007s\n```\n\nSampled during the hang, the worker had consumed 42.9 seconds of CPU on one fully occupied core with flat resident memory, and unauthenticated `GET /health` timed out for as long as the process lived, including after the attacker\u0027s connection closed.\n\nOn 0.11.1 the same payload returns HTTP 200 in 0.011s, `/health` stays available throughout, and deleting a middle message from a well-formed four-message chain still resolves the current message correctly.\n\n## Credits\n@Classic298, who found the unguarded descent through the chat\u0027s child links, demonstrated the resulting server-wide outage end to end against a live instance, and supplied the fix.",
  "id": "PYSEC-2026-3877",
  "modified": "2026-09-10T11:02:18.786171Z",
  "published": "2026-09-10T09:45:01.836438Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3cgp-3cqx-j8w2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/pull/28035"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/b933292d63d12be3fd1416fe55519ddc7aa336bc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/open-webui"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-3cgp-3cqx-j8w2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88000"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree"
}