CVE-2026-87013: Denial of Service via Cyclic Folder Structures in Open WebUI

The Open WebUI platform is a feature-rich, self-hosted user interface designed for interacting with large language models. To facilitate user organization of prompts, custom agents, and active chat sessions, the platform includes a folder hierarchy subsystem. Folders are represented in the backend database as discrete entries containing an ID and an optional parent ID pointer, constructing a directed tree structure. The endpoint POST /api/v1/folders/{id}/update/parent is responsible for handling parent folder reassignments when users move folders within the interface.\n\nPrior to version 0.11.1, Open WebUI did not perform validation checks on parent folder updates to determine whether the proposed parent was the folder itself or one of its descendants. This omission allowed authenticated users to configure folder trees with circular references, effectively introducing directed cycles within the database graph. When recursive operations are executed against these components, the absence of a visited-node tracking mechanism leads to infinite iterations.\n\nThe resulting vulnerability is classified under CWE-835: Loop with Unreachable Exit Condition. Although the vulnerability requires low-privileged authentication to trigger, it presents a reliable vector for denial of service. A single user can lock up database access and application server threads by forcing the backend to endlessly loop through queries and memory-appends, exhausting the available pool of system resources.

The core issue stems from a logical failure during the write-path operation of updating folder hierarchies. In the backend implementation, a folder is modeled with an identifier and a nullable parent identifier field. When the parent ID is updated, the server processes the database change immediately. However, it lacks hierarchical structure validation, allowing a folder's parent pointer to refer to any target, including its own children or itself.\n\nOnce a cycle is introduced, any routine traversing the tree recursively from top-to-bottom or bottom-to-top will run into an infinite loop. The tree traversal logic executes a depth-first search (DFS) without maintaining a registry of previously visited identifiers. Consequently, when the recursive iterator navigates to a child node that references an ancestor as its parent, the execution state loops indefinitely.\n\nThis execution loop occurs synchronously on the application worker thread. While Python's asynchronous model (async/await) allows thread yielding during database queries, the absolute consumption of database connections and synchronous data appends inside the cycle causes immediate thread starvation. The continuous scheduling of the looping task blocks other operations, resulting in application exhaustion and localized Denial of Service.

The vulnerable logic is visible across several backend services, including retrieval, deletion, and permission checking. In the vulnerable version of backend/open_webui/models/folders.py, the subtree extraction function get_children does not keep track of nodes already visited during recursive execution:\n\npython\n# Vulnerable recursive retrieval logic in folders.py\nasync def get_children(folder):\n children = await self.get_folders_by_parent_id_and_user_id(folder.id, user_id, db=db)\n for child in children:\n # Recursion triggers without tracking visited folder IDs\n await get_children(child)\n folders.append(child)\n\n\nThe patch implemented in commit 23b3a69bc26839bfa74edd1be6bfa2568ae902f4 fixes this structural risk by maintaining a seen_ids set on both retrieval and deletion paths. If an ID is encountered that already exists within the set, the recursion path is aborted:\n\npython\n# Patched recursive retrieval logic in folders.py\nasync def get_children_folders_by_id_and_user_id(id, user_id, db):\n # ...\n folders = []\n seen_ids = {id}\n\n async def get_children(folder):\n children = await self.get_folders_by_parent_id_and_user_id(folder.id, user_id, db=db)\n for child in children:\n if child.id in seen_ids:\n continue # Abort cycle if the child folder was already visited\n seen_ids.add(child.id)\n await get_children(child)\n folders.append(child)\n\n\nAdditionally, the patch implements preventive validations inside the update router (backend/open_webui/routers/folders.py). It queries the database to verify whether the new parent_id resides within the folder's existing subtree before allowing the record modification:\n\npython\n# Preventative validation check during parent updates\nif form_data.parent_id and form_data.parent_id in await Folders.get_folder_ids_by_id_and_user_id_in_subtree(\n id, user.id, db=db\n):\n raise HTTPException(\n status_code=status.HTTP_400_BAD_REQUEST,\n detail=ERROR_MESSAGES.DEFAULT('Cannot move a folder into itself or one of its subfolders'),\n )\n

To exploit this vulnerability, an attacker must first obtain a standard, low-privileged authenticated session on the Open WebUI application. No administrator permissions are necessary to trigger the flaw, as the affected endpoint is accessible to any registered user managing their folders.\n\nFirst, the attacker identifies two folders owned by their user account, for example, folder_A and folder_B. They send an HTTP POST request to nested folder endpoints to place folder_B under folder_A. Next, they issue another POST request targeting the endpoint of folder_A and set its parent identifier to folder_B. This API call constructs a closed loop within the database:\n\nhttp\nPOST /api/v1/folders/folder_A_id/update/parent HTTP/1.1\nHost: target.domain\nAuthorization: Bearer <user_jwt_token>\nContent-Type: application/json\n\n{\n \"parent_id\": \"folder_B_id\"\n}\n\n\nOnce the database record is saved with the cyclic structure, the attacker triggers the infinite loop by executing any API action that causes a recursive tree walk. A common trigger is deleting folder_A, retrieving the folder structure, or loading active UI elements that query folder memberships. As the server receives the request, it gets locked in the infinite recursion loop, fully exhausting a CPU core and rapidly filling the available heap.

The primary impact of CVE-2026-87013 is localized Denial of Service (DoS). Because Python's standard web deployments run on limited worker processes (typically controlled by Gunicorn or Uvicorn), locking up even a few worker threads through recursive infinite loops can render the entire application completely unresponsive to all other users.\n\nFurthermore, introducing a cycle causes structural corruption within the user interface. Cyclic folders cannot locate their root ancestor; consequently, they fail to render in the UI sidebar, disappearing from standard client view. Because the database contains corrupted foreign key mappings, affected users are unable to delete or modify these "invisible" folders from the frontend, requiring direct database administrator intervention to clean up.\n\nThe vulnerability has been assigned a CVSS score of 4.3 (Medium). This reflects the low complexity of the attack, the network vector, and the low privilege requirement, combined with a partial loss of availability. Although it does not expose sensitive data or facilitate arbitrary code execution, the ease with which a standard user can disrupt system availability makes it an important flaw to address in multi-user deployments.

The definitive resolution for this issue is upgrading Open WebUI to version 0.11.1 or above. The update implements rigorous validation on the write-path to block the creation of cyclic parent-child links, and integrates self-healing recovery logic on the read-path to automatically re-root folders when structural cycles are detected.\n\nmermaid\ngraph LR\n A[\"Client API Request\"] --> B{\"Validation Check\"}\n B -- \"Cycle Detected\" --> C[\"HTTP 400 Bad Request\"]\n B -- \"No Cycle\" --> D[\"Write to DB\"]\n\n\nIf upgrading is not immediately possible, administrators can mitigate the risk by deploying a custom Web Application Firewall (WAF) rule to block self-referential parent updates. Specifically, rules should match POST requests to /api/v1/folders/(?P<id>[^/]+)/update/parent and compare the path variable {id} with the JSON body key parent_id. If they are identical, the WAF should drop the request immediately.\n\nAlternatively, database administrators can identify and resolve loops manually by executing a recursive Common Table Expression (CTE) query to find circular references. If any are discovered, setting the parent_id column of the looping nodes to NULL will safely break the cycle and restore normal system operations.