Three Open WebUI flaws let any user freeze the server

Open WebUI has patched three security flaws that let ordinary logged-in users take the server down for everyone, or rewrite another person's words in a shared channel. Security advisories published on 9 and 10 September 2026 say all three are fixed in version 0.11.1.

The two denial-of-service issues, tracked as CVE-2026-88002 and CVE-2026-88000, both come from the same underlying weakness: chat histories are stored as an unvalidated JSON object, so the server accepts whatever structure a user submits. According to the advisories, an account with the default user role is enough. No administrator rights, extra permissions or non-default settings are needed, and the attack runs entirely against the attacker's own chat.

In the first case, the code that rebuilds a chat's message chain tracked which messages it had already seen using each message's own id field, but moved through the history by map key. A message that simply left out id was never recorded as visited, so a history whose messages pointed at each other as parents sent the walk round in circles forever. The advisory says builds from 0.5.0 up to and including 0.11.0 are affected.

The second bug sits in the code that picks a chat's new current message after a deletion. That descent through child links kept no record of where it had been, so two messages naming each other as children bounced it back and forth indefinitely. Versions before 0.10.0 are unaffected because the message-deletion endpoint did not exist.

The impact is severe because the walk is synchronous and runs on the server's event loop. While it spins, every request from every user is blocked, including the unauthenticated /health endpoint and administrator APIs, so orchestrator liveness probes fail alongside the interface. The work is not cancelled when the client disconnects, so a single fire-and-forget request suffices. Crucially, the malformed chat stays in the database, so restarting the process does not help: the next request that touches that chat hangs the new process too. In one proof of concept, a worker pinned a full CPU core and reached 1.86 GB of resident memory within 60 seconds and was still growing. Neither flaw discloses, alters or deletes data.

The third issue, CVE-2026-87994, is an integrity problem. The channel branch of the chat completions endpoint checked that the caller could write to a channel and that the targeted message belonged to it, but never checked who wrote that message. Any member able to post could therefore replace another member's text, which was then stored and displayed under the original author's name. The advisory calls this a loss of integrity and non-repudiation. The dedicated channel edit route already applied the correct authorship check and refused the same edit. Channels are off by default, so deployments that never enabled them are not affected.

The fixes add proper visited-tracking to both walks and an authorship comparison to the completions path. Upgrading to 0.11.1 resolves all three, including chats already stored while running an affected version, and requires no configuration change.