The vulnerability resides in Django’s UpdateCacheMiddleware, which fails to add the Authorization header to the Vary response field for requests that include an Authorization token but lack a Cache‑Control: public directive. This omission allows an attacker who can unauthenticatedly request the same URL to retrieve the cached response containing privileged user data. The flaw is classified as CWE‑524: Information Exposure through Missing Permissions.

Products affected are Django prior to version 5.2.15 and prior to 6.0.6, including the 5.2 and 6.0 series. Earlier, unmaintained releases such as Django 5.0.x, 4.1.x and 3.2.x were not explicitly evaluated but may also be impacted.

The CVSS score of 2.3 denotes a low severity impact, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploit. However, the attack vector is remote over HTTP, and the flaw permits information disclosure if a cached response can be accessed. Because the EPSS score is currently unavailable, the likelihood of exploitation remains uncertain but potentially higher in environments where caching is enabled for authenticated content.