This vulnerability arises from Django's caching system, specifically in UpdateCacheMiddleware and the cache_page() decorator, which cache responses that vary based on cookies. If an incoming request includes unrelated cookies, the cache may serve private data intended for other users, allowing remote attackers to access sensitive information from the shared cache. The issue affects Django 6.0 versions before 6.0.7 and 5.2 versions before 5.2.16. Unsupported earlier versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but could potentially be vulnerable. The vulnerability is tracked as CWE-524 (Use of Cache Containing Sensitive Information).

The vulnerability allows remote attackers to read sensitive private data from the shared cache due to improper handling of cached responses that vary on cookies. This can lead to unauthorized disclosure of information. The CVSS score of 4.2 reflects a medium impact with low confidentiality impact, no integrity or availability impact, and requires high attack complexity and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor djangoproject advisories for updates. Until a fix is available, consider disabling or carefully configuring caching mechanisms that vary on cookies to avoid caching sensitive data across users.