The vulnerability in Django's UpdateCacheMiddleware arises because it fails to include the Authorization header in the Vary response header when the request contains Authorization but lacks Cache-Control: public. This omission can cause private cached responses to be served to unauthorized users making unauthenticated requests to the same URL, potentially exposing sensitive information. The issue affects Django 5.2 versions prior to 5.2.15 and 6.0 versions prior to 6.0.6. Earlier unsupported versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may also be vulnerable. The CVSS score is 3.1 (low severity), and no official remediation level or patch links are provided in the data.

Remote attackers can read private cached responses without authentication due to improper cache control handling in Django's middleware. This may lead to exposure of sensitive information cached for authorized users. The impact is limited to information disclosure with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor Django project advisories for updates addressing this issue. Until a fix is available, consider disabling or carefully configuring caching middleware to avoid caching responses that depend on Authorization headers.