CVE-2026-35193 is a vulnerability in Django's middleware cache handling where the UpdateCacheMiddleware fails to include the Authorization header in the Vary response header for requests bearing Authorization without Cache-Control: public. This omission allows remote attackers to retrieve private cached responses via unauthenticated requests to the same URL. The flaw affects Django versions 5.2 prior to 5.2.15 and 6.0 prior to 6.0.6. Unsupported earlier versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may also be vulnerable. The issue is tracked under CWE-524 (Use of Cache Containing Sensitive Information).

The vulnerability enables remote attackers to access private cached responses without authentication by exploiting the lack of Authorization header inclusion in the Vary response header. This could lead to unauthorized disclosure of sensitive information cached by the application. The CVSS score is 3.1 (low severity), indicating limited impact and requiring user interaction with high attack complexity.

A patch is available for this vulnerability. Users should upgrade Django to version 5.2.15 or later, or 6.0.6 or later to remediate the issue. There is no indication that earlier unsupported versions have official fixes; users of those versions should consider upgrading to a supported patched release. No additional mitigation steps are specified by the vendor.