ViewComponent instances retain render‑scoped objects across multiple calls to render_in, allowing stale helpers, request, and controller data to persist. This flaw can cause components that are authorization‑aware to render privileged UI for lower‑privileged users, generate links with stale Host headers, leak slot or helper state, and mix request context during concurrent rendering. The vulnerability is a classic case of stale state and concurrency‑related flaws, as indicated by the associated CWE identifiers.

The vulnerability affects the ViewComponent framework for Ruby on Rails, specifically any installation that uses versions 4.0.0 through 4.12.0 inclusive. These versions allow component instances to be reused across requests, tenants, or threads in a way that is not safe for isolated rendering contexts.

With a CVSS score of 6.8, the vulnerability falls into the medium severity range. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the likely attack vector involves an attacker or malicious user that can influence the reuse of component instances, such as through misconfigured caching or shared instance patterns, to coerce the application into rendering stale or privileged content.