Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read did not track visited folder identifiers. An authenticated user could persist a parent cycle and start a request that consumed CPU and memory indefinitely, with the condition remaining stored until repaired. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T21:17:06.173Z",
  "pubdate": "2026-09-09T21:17:06.173Z",
  "executiveSummary": "Open WebUI versions 0.10.0 through 0.11.1 are vulnerable to a Denial of Service (DoS) condition caused by insufficient validation of folder hierarchical structures.\nThe vulnerability originates from the API endpoint POST /api/v1/folders/{id}/update/parent, which fails to prevent the creation of circular references, allowing a user to nest a folder within its own descendants.\nSubsequent operations, specifically DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read, utilize recursive folder tree-walking algorithms that lack tracking for visited node identifiers.\nBy triggering these operations on a corrupted tree, an authenticated attacker can induce an infinite recursion loop, resulting in uncontrolled consumption of system CPU and memory resources.\nThe persistence of this malicious state allows for prolonged service instability until manual intervention or repair occurs.\nThe attack requires valid user authentication, making the impact significant for multi-tenant or shared instances where unauthorized or malicious users have access to folder management capabilities.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of referential integrity checks during parent-child relationship updates within the Open WebUI folder management system.\nSpecifically, the endpoint POST /api/v1/folders/{id}/update/parent permits a user to re-parent a folder to any of its own children, effectively creating a self-referential or cyclic graph structure in the underlying storage schema.\nThe vulnerability is exacerbated by the implementation of folder traversal logic in the DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read endpoints.\nThese functions perform a recursive tree walk without maintaining a 'visited' set or depth-limit counter to detect cycles. Consequently, when the application attempts to process a folder tree containing a cycle, the recursive function calls itself indefinitely.\nThe attack flow proceeds as follows: First, the attacker identifies a target folder structure they have permissions to manage. Second, the attacker sends a crafted POST /api/v1/folders/{id}/update/parent request that moves a parent folder into one of its children or descendants, establishing the circular reference.\nThird, the attacker triggers the vulnerability by invoking either the deletion or the read operation on the corrupted folder node. The backend process begins a recursive descent, which quickly exhausts the stack or enters an infinite loop, consuming CPU cycles and allocating memory until the process crashes or the service becomes unresponsive.\nThis vulnerability is classified as an Uncontrolled Resource Consumption, as the recursive traversal lacks an exit condition when revisiting nodes. Because the state is stored in the application database, the DoS condition persists across application restarts until the specific record causing the cycle is surgically removed from the data store.\nAffected versions are identified as 0.10.0 through 0.11.1. The attack is achievable by any authenticated user with sufficient permissions to modify folder hierarchies, requiring no specialized administrative privileges beyond standard authenticated access to the folder management API."
}