Django’s UpdateCacheMiddleware and the cache_page decorator improperly cache responses that should vary based on cookies when an incoming request contains unrelated cookies. As a result, an attacker can cause a private response to be stored in a shared cache and later retrieve that cached content, exposing confidential data to the attacker. This flaw leads to information disclosure and is classified as CWE‑524.

The vulnerability is present in Django 6.0 prior to 6.0.7 and Django 5.2 prior to 5.2.16. Earlier unsupported Django series, such as 5.0.x, 4.1.x and 3.2.x, were not evaluated but may also be affected if they use UpdateCacheMiddleware or cache_page.

The CVSS score of 2.3 indicates low severity, while the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a remote attacker to send a request with unrelated cookies to a Django application that caches a response, after which the attacker can read the cached content and obtain the unintended private data.