CVE-2026-6907 is a medium severity vulnerability in Django's UpdateCacheMiddleware that causes it to cache HTTP responses even when the Vary header includes an asterisk ('*'). This leads to the unintended caching of sensitive information, potentially exposing private data to unauthorized users. The flaw affects Django versions 6.0 prior to 6.0.5 and 5.2 prior to 5.2.14, with earlier unsupported versions possibly impacted. The vulnerability is categorized under CWE-524, which involves the use of caches containing sensitive information. No official patch or remediation level is specified in the available data, and no known exploits are reported in the wild.

The vulnerability can cause private data to be cached and served incorrectly, potentially exposing sensitive information to unauthorized parties. However, the CVSS score of 4.3 indicates a medium impact primarily affecting confidentiality, with no impact on integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the official Django vendor advisory for current remediation guidance. Since no official patch or remediation level is provided in the available data, users should monitor Django's security advisories for updates. Until a fix is confirmed, avoid configurations that cause the Vary header to contain an asterisk or disable caching middleware if feasible to reduce risk.