CVE-2026-88000: Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat’s new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages list each other as children, then delete a message from it, and the walk would run forever. That walk runs on the server’s request loop, so it blocks every other user’s requests until the process is killed.