resolved
Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadata
Bug reported by Juan Manuel Linares Rodriguez was disclosed at November 3, 2026, 9:22 pm | Missing Authentication for Critical Function
A missing authentication vulnerability was discovered in an employee-only internal API endpoint. The endpoint was protected by an edge rule that only checked the URL path, but the underlying framework served the same content at an alternate URL structure that bypassed this protection. Unauthenticated users could access merchant installation data including store identifiers, installation dates, and feature flags. The vulnerability was remediated by implementing authentication checks in the application code itself rather than relying solely on edge-level protection.
resolved
`Vary` cache-key conflation of absent and empty request fields
Bug reported by was disclosed at November 3, 2026, 6:51 pm |
A cache-key generation vulnerability was identified in Django's cache middleware that conflated absent and empty request fields nominated by Vary headers. When a request header was absent versus present with an empty value, the same cache key was generated, causing responses intended for one request state to be returned for the other. This behavior violated HTTP caching standards that require absent nominated fields to match only other requests where that field is also absent. The vulnerability allowed cached private responses to be disclosed to requests in different states, as demonstrated through a proof of concept that showed a private response cached for a request with an empty header being returned to a request without that header.