CVE-2026-88002: Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat’s message chain detected repeats using each message’s own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose messages referenced each other in a parent cycle therefore made the walk run forever. Any account with the default user role could store such a chat and trigger the walk, blocking the server for everyone.