CVE-2026-48588
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies even when the incoming request carries unrelated cookies, allowing remote attackers to read private data from the shared cache.
Risk Assessment
The organization is at risk of leaking sensitive user data (e.g., sessions, preferences) stored in cookies, which could be read by unauthorized attackers from the shared cache.
Recommendation
Immediately upgrade Django to version 6.0.7 or 5.2.16 (or later). If an upgrade is not possible, temporarily disable caching of cookie-dependent responses or implement a custom caching layer.
Original NVD description (English source)
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.