EUVD-2026-42629

Open WebUI: Cross-user model-list exposure via static cache key in getallmodels aiocache key= vs keybuilder= misuse...

CVE-2026-59213

Open WebUI (self-hosted AI platform) is affected in versions 0.6.27–0.10.0 by a bug in get_all_models handlers (routers/openai.py and routers/ollama.py) where a lambda was passed to aiocache key instead of key_builder. This caused permission-filtered per-user model lists to share a static cache e...