Self-Hosted AI Platform Vulnerability in Open WebUI
CVE-2026-87013

4.3MEDIUM

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87013?

A flaw exists in Open WebUI from versions 0.10.0 to 0.11.1 where a user could improperly manipulate folder hierarchy through the API. This could lead to the creation of cyclical references within the folder structure, causing excessive consumption of CPU and memory resources. The flaw arises due to a failure to correctly track parent-child relationships during folder updates, enabling authenticated users to exploit this weakness and potentially disrupt service. The issue is resolved in version 0.11.1.

Affected Version(s)

open-webui >= 0.10.0, < 0.11.1

References

https://github.com/open-webui/open-webui/security/advisor...
x_refsource_CONFIRM
https://github.com/open-webui/open-webui/pull/28748
x_refsource_MISC
https://github.com/open-webui/open-webui/commit/23b3a69bc...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.