A flaw in Apache Cocoon allows a user to read entries cached for another user, effectively leaking sensitive information that was originally protected by the caching layer. The defect corresponds to CWE‑524, where the system fails to isolate per-user data stored in a shared cache. Consequently, confidentiality of user content is compromised and the application may serve incorrect data to end users.

All versions of Apache Cocoon are vulnerable. The project has been retired and no further patches will be released, so the only avenue for protection is to migrate away from this software or tightly control who can access it.

The exploit requires that a malicious or compromised user shares a Cocoon instance with other legitimate users; the attacker can then trigger cache reads that return another user's data. The CVSS score of 7.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, indicating that there is currently no known active exploitation. However, because no fix exists, the risk remains high in any environment where Cocoon is still deployed. The likely attack vector is a trusted‑user scenario, but the scope could widen if an attacker gains the ability to influence cache population.