CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

CVE-2026-74791

Scriban before 7.0.0 contains an Authorization Bypass via Stale Include Cache. The issue is that, when TemplateContext.Reset() is called, the CachedTemplates dictionary is not cleared, allowing cached templates to persist across reused contexts. Attackers could leverage request-dependent ITemplat...

CVE-2026-74791: Sensitive Information in Resource Not Removed Before Reuse

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...

PT-2026-73159

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earli...