{"data":{"id":"c2150cdb-8b95-467b-97a8-4dbb5112d5eb","title":"GHSA-3wp3-xxj9-5jqq: Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)","summary":"The `get_all_models` handlers in `routers/openai.py` and `routers/ollama.py` in Open WebUI wrap their permission-filtered model lists in `@cached`, but pass `key=` instead of `key_builder=`. In aiocache 0.12.3, this makes every caller share one static cache entry within `MODELS_CACHE_TTL` (default 1 second), so one user can receive another user's model list, including models they are not permitted to see. The attacker cannot choose the victim or force a target's list into the cache.","solution":"Replace `key=` with `key_builder=` at both call sites and make the lambda take the function as its first argument, keying the cache on `user.id`, as in: @cached(ttl=MODELS_CACHE_TTL, key_builder=lambda _func, request, user=None: (f'openai_all_models_{user.id}' if user else 'openai_all_models'))","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-3wp3-xxj9-5jqq","publishedAt":"2026-07-24T17:03:21.000Z","cveId":"CVE-2026-59213","cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["open-webui@>= 0.6.27, < 0.10.0 (fixed: 0.10.0)"],"affectedPackageNames":["open-webui"],"affectedPackageRefs":["pypi:open-webui"],"affectedVendors":[],"affectedVendorsRaw":["Open WebUI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00373,"epssCheckedAt":"2026-11-04T18:09:12.971Z","kevDateAdded":null,"advisoryAliases":["GHSA-3wp3-xxj9-5jqq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-24T17:03:21.000Z","fixReleasedAt":"2026-06-29T19:24:31.831Z","daysToFix":-25,"fixCheckedAt":"2026-10-29T21:32:37.187Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"open-webui","fixedVersion":"0.10.0","matchedVersion":"0.10.0","fixReleasedAt":"2026-06-29T19:24:31.831Z","daysToFix":-25,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:37.039Z"}]}}