CVE-2026-74791 - Scriban before 7.0.0 Authorization Bypass via Stale Include Cache
Brief
CVE ID : CVE-2026-74791
Published : Aug. 16, 2026, 2:16 p. m.
- 50 minutes ago
Description : Scriban before 7.
- 0 fails to clear the CachedTemplates dictionary when TemplateContext. Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader. Load() again.
Severity: 9.2
- CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...