From 4360f345760ae3203016c382b5f72b7911ad6e88 Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Sat, 30 May 2026 11:01:05 +0800
Subject: [PATCH] fix: get_apiusers cache key missing orgid causing cross-org
 data leak

---
 uapi/apidata.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/uapi/apidata.py b/uapi/apidata.py
index f536aa2..6bfa8fe 100644
--- a/uapi/apidata.py
+++ b/uapi/apidata.py
@@ -81,7 +81,7 @@ class UAPIData:
 		return None
 
 	async def get_apiusers(self, appid, orgid=None):
-		key = appid
+		key = f'{appid}.{orgid}' if orgid else str(appid)
 		if _cache_enabled():
 			d = self.org_users.get(key)
 			if d: