Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
## Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had already visited. A single request against a folder in a loop therefore never finishes. ## Preconditions Folders must be enabled (`ENABLE_FOLDERS`, default true) and the acting user's role must hold the folders feature permission (`USER_PERMISSIONS_FEATURES_FOLDERS`, default true). Both are on in a default install. Any authenticated account is sufficient: no administrator, no second user, no shared folder and no victim interaction. Deployments that disable folders, or withhold the folders feature permission from non-admin roles, are not affected. ## Impact A single request that never returns. It keeps running after the client disconnects, holds a CPU core and grows its in-memory folder list at roughly 0.6 GB per hour until the process is restarted. The folder stays in the looping state in the database, so any later request touching that folder starts the loop again. The instance stays responsive while this happens. Each step of the walk waits on a database query, so other users continue to be served normally; measured on a default install, two concurrent instances of this request left unrelated users unaffected, and roughly 900 concurrent requests were needed before anyone else saw
PYSEC-2026-4121
Revision 1
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
## Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had already visited. A single request against a folder in a loop therefore never finishes. ## Preconditions Folders must be enabled (`ENABLE_FOLDERS`, default true) and the acting user's role must hold the folders feature permission (`USER_PERMISSIONS_FEATURES_FOLDERS`, default true). Both are on in a default install. Any authenticated account is sufficient: no administrator, no second user, no shared folder and no victim interaction. Deployments that disable folders, or withhold the folders feature permission from non-admin roles, are not affected. ## Impact A single request that never returns. It keeps running after the client disconnects, holds a CPU core and grows its in-memory folder list at roughly 0.6 GB per hour until the process is restarted. The folder stays in the looping state in the database, so any later request touching that folder starts the loop again. The instance stays responsive while this happens. Each step of the walk waits on a database query, so other users continue to be served normally; measured on a default install, two concurrent instances of this request left unrelated users unaffected, and roughly 900 concurrent requests were needed before anyone else saw
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:PYSEC-2026-4121
open-webui
Source reference: /affected/0/package/name
- Affected versions
- 0.10.0
Source reference:
/affected/0/versions0.10.1Source reference:
/affected/0/versions0.10.2Source reference:
/affected/0/versions0.11.0Source reference:
/affected/0/versions - Fixed versions
- 0.11.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.10.0"
},
{
"fixed": "0.11.1"
}
]
}
],
"package": {
"name": "open-webui",
"purl": "pkg:pypi/open-webui",
"ecosystem": "PyPI"
},
"versions": [
"0.10.0",
"0.10.1",
"0.10.2",
"0.11.0"
],
"database_specific": {
"source": "https://github.com/pypa/advisory-database/blob/main/vulns/open-webui/PYSEC-2026-4121.yaml"
}
}
]- Related CVEs
- CVE-2026-87013
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #62484 · Revision 1
- Added to Heist Feed
- Publisher date
GHSA-8r35-5x5r-hv74
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-8r35-5x5r-hv74
open-webui
Source reference: /affected/0/package/name
- Affected versions
- 0.10.0
Source reference:
/affected/0/versions0.10.1Source reference:
/affected/0/versions0.10.2Source reference:
/affected/0/versions0.11.0Source reference:
/affected/0/versions - Fixed versions
- 0.11.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.10.0"
},
{
"fixed": "0.11.1"
}
]
}
],
"package": {
"name": "open-webui",
"purl": "pkg:pypi/open-webui",
"ecosystem": "PyPI"
},
"versions": [
"0.10.0",
"0.10.1",
"0.10.2",
"0.11.0"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8r35-5x5r-hv74/GHSA-8r35-5x5r-hv74.json",
"last_known_affected_version_range": "<= 0.11.0"
}
}
]- Related CVEs
- CVE-2026-87013
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #62548 · Revision 1
- Added to Heist Feed
- Publisher date