DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59213: CVE-2026-59213: Authorization Bypass and Cross-Session Cache Leakage in Open WebUI

#security #cve #cybersecurity

CVE-2026-59213: Authorization Bypass and Cross-Session Cache Leakage in Open WebUI

Vulnerability ID: CVE-2026-59213
CVSS Score: 3.5
Published: 2026-07-24

An authorization bypass and cross-session cache leakage vulnerability exists in the model-listing backend of Open WebUI. The flaw stems from a configuration error in the @cached decorator of the aiocache library, which maps all unique user session queries to a single static cache key.

TL;DR

Open WebUI's improper use of the aiocache decorator collapses per-user model lists into a single cache key, allowing low-privileged users to leak restricted model metadata during the 1-second TTL window.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-524: Use of Cache Containing Sensitive Information
  • Attack Vector: Network (AV:N)
  • CVSS Severity Score: 3.5 (Low)
  • EPSS Score: 0.00296
  • Impact: Information Disclosure / Access Control Bypass
  • Exploit Status: PoC (Proof of Concept)
  • KEV Status: Not Listed

Affected Systems

  • Open WebUI Backend (openai and ollama routers)
  • Open WebUI: >= 0.6.27, < 0.10.0 (Fixed in: 0.10.0)

Code Analysis

Commit: 0fc630b

Fix caching key evaluation issue in openai and ollama routers

Exploit Details

Mitigation Strategies

  • Upgrade Open WebUI to version 0.10.0 or newer.
  • Disable model listing caching temporarily by setting MODELS_CACHE_TTL to 0.
  • Audit custom middleware and caching logic to ensure dynamic keys are built using proper callback structures.

Remediation Steps:

  1. Determine current running version of Open WebUI backend.
  2. Apply application upgrade to version 0.10.0 or higher.
  3. Restart the backend application services or container instance.
  4. Validate user access separation by querying the API endpoints with a low-privileged test account.

References

Read the full report for CVE-2026-59213 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)