Vulnerabilities CVE-2026-74791

CVE-2026-74791

Critical

Open

TLP:CLEAR

Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.

Details

CVSS Score: 9.2
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Confidence: 90%
Published: Aug 16, 2026
Last Modified: Aug 16, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.