GHSA-QPC8-7FXC-CM4P Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not add Authorization to the Vary response header for requests bearing that header without Cache-Control: public, which allows remote attackers to read private...