{"id":"CVE-2026-108088","kind":"vulnerability","aliases":["CVE-2026-108088"],"related":[],"title":"Apache Cocoon: shared cache can serve one user's content to another","description":"** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users.\n\n\n\nThis issue affects Apache Cocoon: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","summary":"When Apache Cocoon's cache is used in a multi-user application, cached values for one user can be served to other users. An attacker may therefore see content that was generated for someone else.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-cocoon","java","package","self-hosted"],"not_affected_if":["auth-required","single-user"],"how_to_check":"- Check whether the project depends on Apache Cocoon, for example by searching the build files or `pom.xml` for `cocoon`.\n- Check whether the Cocoon cache is enabled and whether the instance serves more than one user.","fix":"- The project is retired and no fixed version will be released.\n- Move to an alternative, or restrict access to the instance to trusted users only.","status":"open","published_at":"2026-10-20T11:17:16+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T05:04:52+00:00","updated_at":"2026-10-25T05:04:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:52Z","model":"claude-haiku-5-5","output":{"fix":"- The project is retired and no fixed version will be released.\n- Move to an alternative, or restrict access to the instance to trusted users only.","reach":"unknown","title":"Apache Cocoon: shared cache can serve one user's content to another","impact":"medium","summary":"When Apache Cocoon's cache is used in a multi-user application, cached values for one user can be served to other users. An attacker may therefore see content that was generated for someone else.","category":"package","nicknames":[],"who_cares":["apache-cocoon","java","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"users read cached content generated for other users","analyst_note":"Check the NVD entry and Apache Cocoon project pages to confirm which cache configuration triggers the cross-user serving.","how_to_check":"- Check whether the project depends on Apache Cocoon, for example by searching the build files or `pom.xml` for `cocoon`.\n- Check whether the Cocoon cache is enabled and whether the instance serves more than one user.","needs_analyst":true,"not_affected_if":["single-user","auth-required"],"who_is_affected":"Teams running Apache Cocoon with its cache enabled in an application that serves multiple users. Single-user deployments, or instances restricted to fully trusted users, are much less exposed. The sources do not say which cache settings are involved beyond the multi-user condition.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000597,"input_tokens":3403,"output_tokens":514,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108088':15A,18A '-2026':14A,17A 'access':133C 'affect':102C,144C 'altern':130C 'anoth':12A 'apach':1A,20B,28B,74C,103C 'apache-cocoon':19B 'applic':39B,85C 'assign':65C 'attack':52B 'cach':4A,31B,40B,68C,79C,86C 'cocoon':2A,21B,29B,75C,104C 'contain':69C 'content':10A,56B,96C 'could':91C 'cve':13A,16A 'els':62B 'find':128C 'fix':121C 'generat':59B 'host':26B 'inform':71C 'instanc':136C 'issu':101C,123C 'java':22B 'longer':149C 'maintain':153C 'may':53B 'multi':37B,83C 'multi-us':36B,82C 'note':140C 'one':7A,43B,89C 'packag':23B 'plan':115C 'product':145C 'project':109C 'recommend':126C 'releas':117C 'restrict':132C 'retir':111C 'see':55B 'self':25B 'self-host':24B 'sensit':70C 'serv':6A,47B,95C 'share':3A 'someon':61B 'support':150C 'therefor':54B 'trust':138C 'unsupport':63C 'use':33B,66C,77C,93C 'user':8A,38B,44B,50B,84C,90C,99C,124C,139C 'valu':41B,87C 'version':106C,119C 'vulner':72C,142C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Cocoon with its cache enabled in an application that serves multiple users. Single-user deployments, or instances restricted to fully trusted users, are much less exposed. The sources do not say which cache settings are involved beyond the multi-user condition.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108088","severity":null,"published_at":"2026-10-20T11:17:16+00:00","modified_at":"2026-10-20T19:34:00+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}