{"id":"CVE-2026-48588","aliases":["GHSA-3h9f-r86x-qvjx","BIT-django-2026-48588","PYSEC-2026-2090"],"title":"Django: cache middleware may expose private responses when unrelated request cookies are present","summary":"Django: cache middleware may expose private responses when unrelated request cookies are present","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","vendor":"django","product":"django","ecosystem":"pip","affected":["django < 5.2.16","django >= 6.0.0, < 6.0.7"],"patched":["django 5.2.16","django 6.0.7"],"published":"2026-07-07","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:10.140141450Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3h9f-r86x-qvjx","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48588"},{"url":"https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3"},{"url":"https://github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1"},{"url":"https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7"},{"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"url":"https://github.com/django/django"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml"},{"url":"https://groups.google.com/g/django-announce"},{"url":"https://www.djangoproject.com/weblog/2026/jul/07/security-releases"},{"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"url":"https://www.djangoproject.com/weblog/2026/jul/07/security-releases/"}],"tags":["osv","pip"],"epss":0.00429,"epssPercentile":0.36586,"ingestedAt":"2026-07-10T18:56:50.628Z","slug":"CVE-2026-48588","body":"## Overview\n\nAn issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Chris Whyland for reporting this issue.\n\n## Affected packages\n\n- `django < 5.2.16`\n- `django >= 6.0.0, < 6.0.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `django 5.2.16`\n- `django 6.0.7`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201702,"id":"CVE-2026-48588","ts":1789399626945,"field":"cvss","old":"5.3","new":"3.1"},{"seq":201701,"id":"CVE-2026-48588","ts":1789399626945,"field":"severity","old":"medium","new":"low"},{"seq":200434,"id":"CVE-2026-48588","ts":1789397253054,"field":"cvss","old":"3.1","new":"5.3"},{"seq":200433,"id":"CVE-2026-48588","ts":1789397253054,"field":"severity","old":"low","new":"medium"},{"seq":198358,"id":"CVE-2026-48588","ts":1789391865233,"field":"cvss","old":"5.3","new":"3.1"},{"seq":198357,"id":"CVE-2026-48588","ts":1789391865233,"field":"severity","old":"medium","new":"low"},{"seq":196149,"id":"CVE-2026-48588","ts":1789383513717,"field":"cvss","old":"3.1","new":"5.3"},{"seq":196148,"id":"CVE-2026-48588","ts":1789383513717,"field":"severity","old":"low","new":"medium"},{"seq":195078,"id":"CVE-2026-48588","ts":1789380394443,"field":"cvss","old":"5.3","new":"3.1"},{"seq":195077,"id":"CVE-2026-48588","ts":1789380394443,"field":"severity","old":"medium","new":"low"},{"seq":193865,"id":"CVE-2026-48588","ts":1789378373876,"field":"cvss","old":"3.1","new":"5.3"},{"seq":193864,"id":"CVE-2026-48588","ts":1789378373876,"field":"severity","old":"low","new":"medium"},{"seq":192652,"id":"CVE-2026-48588","ts":1789376343317,"field":"cvss","old":"5.3","new":"3.1"},{"seq":192651,"id":"CVE-2026-48588","ts":1789376343317,"field":"severity","old":"medium","new":"low"},{"seq":191439,"id":"CVE-2026-48588","ts":1789373274406,"field":"cvss","old":"3.1","new":"5.3"},{"seq":191438,"id":"CVE-2026-48588","ts":1789373274406,"field":"severity","old":"low","new":"medium"},{"seq":190224,"id":"CVE-2026-48588","ts":1789369228075,"field":"cvss","old":"5.3","new":"3.1"},{"seq":190223,"id":"CVE-2026-48588","ts":1789369228075,"field":"severity","old":"medium","new":"low"},{"seq":189011,"id":"CVE-2026-48588","ts":1789368154642,"field":"cvss","old":"3.1","new":"5.3"},{"seq":189010,"id":"CVE-2026-48588","ts":1789368154642,"field":"severity","old":"low","new":"medium"},{"seq":187794,"id":"CVE-2026-48588","ts":1789365080753,"field":"cvss","old":"5.3","new":"3.1"},{"seq":187793,"id":"CVE-2026-48588","ts":1789365080753,"field":"severity","old":"medium","new":"low"},{"seq":186581,"id":"CVE-2026-48588","ts":1789363139054,"field":"cvss","old":"3.1","new":"5.3"},{"seq":186580,"id":"CVE-2026-48588","ts":1789363139054,"field":"severity","old":"low","new":"medium"},{"seq":185367,"id":"CVE-2026-48588","ts":1789361038998,"field":"cvss","old":"5.3","new":"3.1"},{"seq":185366,"id":"CVE-2026-48588","ts":1789361038998,"field":"severity","old":"medium","new":"low"},{"seq":184154,"id":"CVE-2026-48588","ts":1789358040701,"field":"cvss","old":"3.1","new":"5.3"},{"seq":184153,"id":"CVE-2026-48588","ts":1789358040701,"field":"severity","old":"low","new":"medium"},{"seq":182405,"id":"CVE-2026-48588","ts":1789354162202,"field":"cvss","old":"5.3","new":"3.1"},{"seq":182404,"id":"CVE-2026-48588","ts":1789354162202,"field":"severity","old":"medium","new":"low"},{"seq":181198,"id":"CVE-2026-48588","ts":1789353023653,"field":"cvss","old":"3.1","new":"5.3"},{"seq":181197,"id":"CVE-2026-48588","ts":1789353023653,"field":"severity","old":"low","new":"medium"},{"seq":179991,"id":"CVE-2026-48588","ts":1789350100783,"field":"cvss","old":"5.3","new":"3.1"},{"seq":179990,"id":"CVE-2026-48588","ts":1789350100783,"field":"severity","old":"medium","new":"low"},{"seq":178784,"id":"CVE-2026-48588","ts":1789347975041,"field":"cvss","old":"3.1","new":"5.3"},{"seq":178783,"id":"CVE-2026-48588","ts":1789347975041,"field":"severity","old":"low","new":"medium"},{"seq":177577,"id":"CVE-2026-48588","ts":1789346237246,"field":"cvss","old":"5.3","new":"3.1"},{"seq":177576,"id":"CVE-2026-48588","ts":1789346237246,"field":"severity","old":"medium","new":"low"},{"seq":176370,"id":"CVE-2026-48588","ts":1789342891348,"field":"cvss","old":"3.1","new":"5.3"},{"seq":176369,"id":"CVE-2026-48588","ts":1789342891348,"field":"severity","old":"low","new":"medium"},{"seq":175824,"id":"CVE-2026-48588","ts":1789338675090,"field":"cvss","old":"5.3","new":"3.1"},{"seq":175823,"id":"CVE-2026-48588","ts":1789338675090,"field":"severity","old":"medium","new":"low"},{"seq":175694,"id":"CVE-2026-48588","ts":1789338495066,"field":"cvss","old":"3.1","new":"5.3"},{"seq":175693,"id":"CVE-2026-48588","ts":1789338495066,"field":"severity","old":"low","new":"medium"},{"seq":174489,"id":"CVE-2026-48588","ts":1789334680355,"field":"cvss","old":"5.3","new":"3.1"},{"seq":174488,"id":"CVE-2026-48588","ts":1789334680355,"field":"severity","old":"medium","new":"low"},{"seq":173284,"id":"CVE-2026-48588","ts":1789333366061,"field":"cvss","old":"3.1","new":"5.3"},{"seq":173283,"id":"CVE-2026-48588","ts":1789333366061,"field":"severity","old":"low","new":"medium"},{"seq":172098,"id":"CVE-2026-48588","ts":1789330949749,"field":"cvss","old":"5.3","new":"3.1"},{"seq":172097,"id":"CVE-2026-48588","ts":1789330949749,"field":"severity","old":"medium","new":"low"}]}