Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

GHSA-3CGP-3CQX-J8W2 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

GHSA-JQHH-CJMQ-VMV6 Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...