Open WebUI’s get_all_models endpoint in the OpenAI and Ollama routers builds cache keys incorrectly by passing a lambda to the aiocache key parameter instead of using key_builder. This mistake causes all users to share a single static cache entry that contains a permission‑filtered list of available models. As a result, an authenticated user may see another user’s list of models breach that exposes a user’s AI model inventory without granting execution privilege.

Open‑webui:open‑webui is impacted in all releases from 0.6.27 up to, but not including, 0.10.0. The fix that corrects the cache key logic is included in version 0.10.0, so deployments running that version or later are no longer affected.

The CVSS score of 3.5 indicates low severity; the EPSS score of less than 1% indicates a very low probability of exploitation and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is any authenticated user who can invoke the get_all_models endpoint on a shared Open WebUI instance; exploitation requires no privileged elevation. The result is limited to the disclosure of another user’s model list during the time‑to‑live of the cached entry, with no impact on configuration, integrity, or availability.