CVE-2026-59213: Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Summary

The getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 (the pinned version), key= is a static cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided onto a single shared cache entry within the TTL window. During that window, one user's permission-filtered model list could be served to a different authenticated user, crossing the per-user authorization boundary.

Impact

- Boundary crossed: Confidentiality (cross-user). A caller can receive the model list scoped to a different security principal than themselves. - A user (or admin, or — depending on endpoint reachability — anonymous caller) who populates the cache causes the next caller within the TTL to receive that list rather than their own permission-filtered one. - What's disclosed is the set of models another principal can access, including potentially the existence and naming of models restricted from the receiving user. - Exposure is incidental and timing-dependent, not attacker-controlled: the leaked entry is whatever the most recent caller populated within MODELSCACHETTL (default 1 second), and the attacker cannot select the victim or force a target's list into the cache.

Affected component

- backend/openwebui/routers/openai.py — getallmodels (~line 488) - backend/openwebui/routers/ollama.py — getallmodels (~line 302)

Both decorated with @cached(ttl=MODELSCACHETTL, key=lambda ...). No other @cached(... key=lambda ...) misuse was found elsewhere in the backend.

Root cause

aiocache 0.12's @cached treats key= as a static key; the per-call hook is keybuilder= with signature keybuilder(func, args, kwargs). Passing a callable to key= uses the callable object itself as a constant key, so every invocation resolved to the same entry and the intended per-user.id namespacing never occurred.

Reproduction (default config)

1. On a default deployment, configure at least two users with different model-access permissions (e.g. one model restricted to user A). 2. As user A, request the model list (populates the shared cache entry). 3. Within MODELSCACHETTL (default 1s), as user B, request the model list. 4. User B receives user A's permission-filtered list, including models B is not permitted to see.

Remediation

Replace key= with keybuilder= at both call sites and adjust the lambda to take the function as its first argument:

python @cached( ttl=MODELSCACHETTL, keybuilder=lambda func, request, user=None: ( f'openaiallmodels{user.id}' if user else 'openaiallmodels' ), )