Apache Cocoon cache can leak one user's data to another (CVE-2026-108088)
On multi-user apps, cached values for one user can be served to others, and no fix is planned.
28
Vulnerability1 · 1 read
CVE-2026-108088
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
Description · NVD
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Weakness
- CWE-524
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N