CVE-2026-6907

score

<0.1

cvss

4.3

epss

0.4%

published

2026-05-05

kev added

—

first seen

2026-10-21

Django < 6.0.5 and < 5.2.14 contain a broken access control vulnerability caused by erroneous caching of requests with a '*' in the Vary header in UpdateCacheMiddleware, letting attackers access private cached data, exploit requires crafted requests with '*' in Vary header.