CVE-2026-35193

score

<0.1

cvss

3.1

epss

0.4%

published

2026-06-03

kev added

—

first seen

2026-10-21

Django 5.2 < 5.2.15 and 6.0 < 6.0.6 contain a broken access control vulnerability caused by missing Authorization header in Vary response header in UpdateCacheMiddleware, letting remote attackers read private cached responses via unauthenticated requests, exploit requires crafted unauthenticated requests.