The view_component framework for Ruby on Rails versions >=4.0.0 and <4.12.0 suffers from a concurrency issue where render-scoped objects are improperly retained across multiple render_in calls. This improper synchronization leads to stale helpers, controller, request, view_flow, format/variant details, and slot child context being reused across requests, users, tenants, or threads. As a result, authorization-aware components may render privileged UI to lower-privileged users, generate links with stale Host headers, leak slot/helper state, and mix request contexts during concurrent rendering. The vulnerability is classified under CWE-362 (Race Condition) and related CWEs. It has a CVSS 3.1 score of 6.8 (medium severity). The issue is resolved in version 4.12.0.

Exploiting this vulnerability can cause authorization bypass in UI rendering, leading to privileged information being shown to unauthorized users. It can also cause leakage of request-specific context and stale data usage, potentially exposing sensitive information or causing incorrect application behavior under concurrent requests. There is no indication of availability impact. No known exploits in the wild have been reported.

Upgrade to view_component version 4.12.0 or later, where this race condition vulnerability is fixed. No other mitigations are indicated or recommended by the vendor. Patch status is confirmed fixed in 4.12.0.