GHSA-3wp3-xxj9-5jqq: Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
Summary
Open WebUI had a caching bug in its model-list endpoints where the `@cached` decorator used `key=` instead of `key_builder=`, causing all users to share a single cache entry instead of each having their own permission-filtered list. This meant one user could briefly see another user's accessible models if they made a request within the 1-second cache window after that user.
Solution / Mitigation
Replace `key=` with `key_builder=` at both call sites in `routers/openai.py` (line ~488) and `routers/ollama.py` (line ~302), adjusting the lambda to take the function as its first argument: `@cached(ttl=MODELS_CACHE_TTL, key_builder=lambda _func, request, user=None: (f'openai_all_models_{user.id}' if user else 'openai_all_models'),)`
Vulnerability Details
EPSS: 0.3%
Yes
July 24, 2026
Classification
Affected Vendors
Affected Packages
Related Issues
Original source: https://github.com/advisories/GHSA-3wp3-xxj9-5jqq
First tracked: July 24, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 92%