Threats Tagged 'cve-2026-54497'

ViewComponent versions 4.0.0 through before 4.12.0 have a vulnerability where component instances retain stale render context across multiple render calls. This can cause components to render with outdated authorization, request, and helper state, potentially exposing privileged UI to unauthorized users, leaking request data, and mixing context in concurrent rendering scenarios. The root cause is that component instances are mutable and memoize request-scoped data without resetting between renders. There is no runtime enforcement preventing reuse of component instances across different requests or users. A proof of concept demonstrates cross-user authorization impact, stale Host headers in URLs, slot child context leakage, and cross-thread context mixing. No official patch or fix is currently documented.