CVE-2026-48588: djangoproject django
Vulnerability summary
CVE-2026-48588 is a medium (CVSS 5.3) vulnerability in djangoproject django. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 07-07-2026PublishedVulnerability first disclosed.
- 07-07-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.
CVSS metrics
9 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVE.orgCNA4.2MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:NDiffers
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard13 products
- authentik-2025.12All versions (No fix recorded)
- authentik-2026.2< 2026.2.6-r14
- authentik-2026.5< 2026.5.6-r6
- authentik-fips-2025.12All versions (No fix recorded)
- authentik-fips-2026.2< 2026.2.6-r14
Debian1 product
- python-django< 3:3.2.25-0+deb12u5 | All versions (No fix recorded) | < 3:5.2.16-1
Djangoproject1 product
- django≥ 5.2, < 5.2.16 | ≥ 6.0, < 6.0.7
PyPI1 product
- django< 5.2.16 | ≥ 6.0.0, < 6.0.7 | ≥ 6.0, < 6.0.7
Ubuntu1 product
- python-djangoAll versions (No fix recorded)
5 vendors · 17 products
References
18 links
- github.com/django/djangoPACKAGE
Show all 18 references
- pypi.org/project/Django/PACKAGE