CVE-2026-48588: django from 5.2 (inclusive), before 5.2.16 (exclusive), from 6.0 (inclusive), before 6.0.7 (exclusive); +1 more…

Affected technology

django · from 5.2 (inclusive), before 5.2.16 (exclusive)
djangoproject

django · from 6.0 (inclusive), before 6.0.7 (exclusive)
djangoproject

Django · 6.0 to before 6.0.7, 5.2 to before 5.2.16
djangoproject

Description’s affected range: before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrel

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

The source says an issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Source advisory’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality impact as low; integrity and availability impact as none.