Open WebUI Cache Misconfiguration: Cross-User Model-List Exposure
An apparent misconfiguration in the caching logic of Open WebUI's `get_all_models` handlers may result in cross-user exposure of permission-filtered model lists.
What happened
Reportedly, the `@cached` decorator in `routers/openai.py` and `routers/ollama.py` was incorrectly set up, leading to a shared cache entry for all users instead of per-user caching. This misconfiguration is under investigation for potentially serving one user's permission-filtered model list to another authenticated user.
Professionals using Open WebUI are advised to review and update the caching logic in the affected files to ensure proper per-user caching. The primary source should be consulted for detailed technical information and recommended actions.
How 0Day mitigates this
open_webui is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.