Lucene search
+L

9 matches found

Github Security Blog
Github Security Blog
added 2026/07/24 5:03 p.m.24 views

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Summary The getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...

5CVSS5.8AI score0.00297EPSS
SaveExploits1References6Affected Software1
Rows per page
Query Builder