Executive brief
A vulnerability in the Django web framework's caching system could allow unauthorized users to view private data. When a website uses certain caching settings, the system may fail to distinguish between public content and content intended only for specific logged-in users. This could result in sensitive information being served to the wrong person if they visit the same web address.
Technical details
A vulnerability exists in django.middleware.cache.UpdateCacheMiddleware where the 'Authorization' header is not automatically added to the 'Vary' response header. This occurs when a request includes an Authorization header but the response does not specify 'Cache-Control: public'. Consequently, a downstream cache or the Django internal cache might serve a response intended for an authenticated user to an unauthenticated attacker requesting the same URL. This is classified as a 'Use of Cache Containing Sensitive Information' (CWE-524). The issue is resolved in Django versions 5.2.15 and 6.0.6.
Affected products
- Django Software Foundation Django >= 5.2.0, < 5.2.15
- Django Software Foundation Django >= 6.0.0, < 6.0.6
Timeline
- 2026-06-03: disclosed
- 2026-06-03: patched
- 2026-06-03: advisory