CyberRota Analysis
AI-GeneratedThe vulnerability affects the Open WebUI platform, specifically versions 0.10.0 to 0.11.1, where an authenticated user can exploit a flaw in the message deletion API to create a cyclic chat tree. This can lead to a denial-of-service condition by causing an infinite loop in the server's request processing, blocking all user requests until the server is restarted. Organizations using affected versions should prioritize upgrading to version 0.11.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-history deletion helper in backend/open_webui/models/chats.py to follow childrenIds without recording visited message identifiers. An authenticated user could store a cyclic chat tree and delete a message, causing a synchronous infinite loop on the server request loop that blocked every user's requests until the process was killed. This issue is fixed in version 0.11.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)