OGNL can be used to access session attributes; if the user list is already in session:
You can also use Nishan's suggestion of retrieving the user list object in the action and exposing it as an action property, but it's probably easier and more testable to implement SessionAware and load the action property from the session attribute map.
Implementing SessionAware doesn't involve any static utilities and makes actions easier to
test in isolation.