SB2026082073 - Use of cache containing sensitive information in Angular

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082073

SB2026082073 - Use of cache containing sensitive information in Angular

Published: August 20, 2026

Security Bulletin ID SB2026082073
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of cache containing sensitive information (CVE-ID: CVE-2026-50170)

CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of cache containing sensitive information in HttpTransferCache when processing delegated HTTP requests with withRequestsMadeViaParent() before parent interceptors attach authentication credentials. A remote attacker can request a cached SSR-rendered page containing another user\'s authenticated response data to disclose sensitive information.

Exploitation requires SSR and hydration to be enabled, a hierarchical HttpClient configuration using withRequestsMadeViaParent(), parent-level injection of authentication credentials, and shared caching of SSR HTML responses across user sessions.


Remediation

Install update from vendor's website.

References