An unauthenticated authorization bypass in the Scriban template engine allows attackers to access sensitive information through stale include caches.

This vulnerability occurs when sensitive information is not properly cleared from the resource cache before reuse. An unauthenticated attacker can manipulate the include cache to access data that should be protected by authorization logic.

The CVSS score of 8.6 highlights the critical nature of this information disclosure flaw. Unauthorized access to sensitive data can lead to significant privacy breaches, regulatory non-compliance, and loss of intellectual property or customer data.

Immediate Action: Update the Scriban and Scriban.Signed NuGet packages to version 7.0.0 or later.

Proactive Monitoring: Review application logs for unusual access patterns or requests that attempt to force-reload template components.

Compensating Controls: Ensure that the application environment does not cache sensitive templates in a shared memory space and implement strict access controls on the file system where templates are stored.

Public Exploit Available: Unknown

This vulnerability requires immediate attention due to the potential for unauthorized data access. Developers should verify their dependencies and upgrade Scriban to version 7.0.0 immediately to remediate the caching logic issue.