Use of Web Browser Cache Containing Sensitive Information in Django - CVE-2026-6907

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU130192

Use of Web Browser Cache Containing Sensitive Information in Django - CVE-2026-6907

Published: May 5, 2026


Vulnerability identifier: #VU130192
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-6907
CWE-ID: CWE-525
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper cache handling in django.middleware.cache.UpdateCacheMiddleware when processing responses whose Vary header contains an asterisk ('*'). A remote attacker can trigger caching of private data to disclose sensitive information.

Private data may be stored in the cache and later served to other users.


Affected software

Django
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
Fedora
python3-Django
python-django-help
python-django
python-django (Ubuntu package)
python311-Django
python-django5
python-django6

How to mitigate CVE-2026-6907

Install security update from vendor's website.

Django - addressed in versions 5.2.14, 6.0.5
python3-Django - addressed in versions 2.2.27-23, 4.2.15-15
python-django-help - addressed in versions 2.2.27-23, 4.2.15-15
python-django - addressed in versions 2.2.27-23, 4.2.15-15
python-django (Ubuntu package) - addressed in versions 2:3.2.12-2ubuntu1.27, 3:4.2.11-1ubuntu1.16, 3:5.2.4-1ubuntu2.5, 3:5.2.9-0ubuntu4.1
python311-Django - update to 4.2.11-150600.3.56.1
python-django5 - addressed in versions 5.2.14-1.fc42, 5.2.14-1.fc43, 5.2.14-1.fc44
python-django6 - update to 6.0.5-1.fc44

External References

Related Security Bulletins