Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-history deletion helper in backend/open_webui/models/chats.py to follow childrenIds without recording visited message identifiers. An authenticated user could store a cyclic chat tree and delete a message, causing a synchronous infinite loop on the server request loop that blocked every user's requests until the process was killed. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T22:18:48.777Z",
  "pubdate": "2026-09-09T22:18:48.777Z",
  "executiveSummary": "Open WebUI versions 0.10.0 through 0.11.1 are susceptible to a Denial of Service (DoS) vulnerability originating from improper handling of chat message hierarchies.\nThe vulnerability is caused by a lack of cycle detection when traversing linked message structures within the chat history deletion logic.\nAn authenticated attacker can exploit this by crafting a malicious chat tree containing cyclical references and triggering a deletion request.\nThis action forces the backend server into an infinite synchronous loop, effectively exhausting process threads and blocking all service requests from other users.\nThe risk implication is significant as it allows a single authenticated user to completely disrupt the availability of the AI platform, necessitating manual intervention to kill and restart the server process.\nThe vulnerability requires the attacker to have authentication to the platform, after which they can manipulate chat data to induce the recursive loop.",
  "technicalDetails": "The vulnerability resides within the backend/open_webui/models/chats.py file, specifically within the helper function responsible for processing chat history deletions.\nWhen a user invokes the DELETE /api/v1/chats/{id}/messages/{message_id} endpoint, the backend attempts to recursively traverse the message tree to delete the target message and its associated childrenIds.\nThe root cause is a failure to maintain a stateful record of visited message identifiers during this recursive traversal. In the absence of a 'visited' set or depth-limiting mechanism, the function blindly follows pointers provided within the chat object's metadata.\nAn attacker can exploit this by manipulating the chat history to include circular references, where a child message points back to one of its ancestors as a subsequent child.\nThe attack flow proceeds as follows: First, the authenticated attacker sends a request to the platform to store a chat structure that contains a cyclical path (e.g., Message A -> Message B -> Message A). Second, the attacker issues a DELETE request targeting a message within this cycle.\nUpon receiving the request, the backend enters the vulnerable deletion helper function. The recursive logic begins processing the chain, following the child pointers. Because the logic does not check if a node has been previously processed, the pointers form an infinite recursive loop.\nBecause the server request loop is synchronous, the execution thread becomes trapped in this infinite recursion. As the process continuously consumes CPU cycles and stack memory, the application becomes unresponsive to all concurrent users, causing a complete system-wide Denial of Service.\nThe impact is immediate and persistent until the server process is externally terminated and restarted by an administrator. This vulnerability demonstrates the dangers of recursive processing on user-controlled input without robust loop detection or cycle validation."
}