CVE-2026-87013

Analyzed Analyzed - Analysis Complete

Parent Cycle in Open WebUI Folder Management

Publication date: 2026-09-09

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read did not track visited folder identifiers. An authenticated user could persist a parent cycle and start a request that consumed CPU and memory indefinitely, with the condition remaining stored until repaired. This issue is fixed in version 0.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-15

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-87013

Affected Vendors & Products

Vendor	Product	Version / Range
openwebui	open_webui	From 0.10.0 (inc) to 0.11.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

Open WebUI versions 0.10.0 to 0.11.1 had a flaw in the folder management API. An authenticated user could create a parent-child folder cycle by exploiting POST /api/v1/folders/{id}/update/parent. This cycle caused infinite loops in DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read operations, leading to excessive CPU and memory consumption.

Detection Guidance

Detecting this vulnerability requires checking the Open WebUI version and verifying if parent cycles exist in folder structures. Check the installed version with: docker inspect open-webui | grep -i version. If using version 0.10.0 to 0.11.0, the system is vulnerable. Inspect folder hierarchies for cycles using API endpoints or database queries.

Impact Analysis

If exploited, this vulnerability could degrade system performance or crash the Open WebUI service due to resource exhaustion. It requires an authenticated user, so unauthorized access is not a direct risk, but legitimate users could unintentionally trigger the issue.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service conditions through resource exhaustion, which may affect availability requirements. Persistent parent cycles could lead to prolonged system instability, potentially violating service continuity expectations under these regulations.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.1 or later immediately. After upgrading, manually inspect folder structures for parent cycles and repair them by reassigning parent folders to valid ancestors. Remove any corrupted folders if necessary.

Hi! I’m here to help you understand CVE-2026-87013. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70