CyberRota Analysis
AI-GeneratedThe vulnerability affects Open WebUI versions prior to 0.10.0, where the get_all_models handlers improperly utilized a lambda for aiocache keys, leading to unauthorized exposure of user-specific model lists due to shared static cache entries. This could allow one user to access another user's model list during the cache's TTL window, potentially compromising user privacy. Organizations using affected versions should prioritize updating to version 0.10.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry and exposing one user’s model list to another caller during the TTL window. This issue is fixed in version 0.10.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)