VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Jan 23, 2007· Updated Apr 23, 2026

CVE-2007-0405

CVE-2007-0405

Description

The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
DjangoPyPI
>= 0.95, < 1.01.0

Affected products

1

Patches

2
e89f0a65581f

0.95-bugfixes: Apply fix to LazyUser from [3754]

https://github.com/django/djangoJames BennettJan 20, 2007via ghsa
commit
1 file changed · +3 −6
  • django/contrib/auth/middleware.py+3 −6 modified
    @@ -1,12 +1,9 @@
 class LazyUser(object):
-    def __init__(self):
-        self._user = None
-
     def __get__(self, request, obj_type=None):
-        if self._user is None:
+        if not hasattr(request, '_cached_user'):
             from django.contrib.auth import get_user
-            self._user = get_user(request)
-        return self._user
+            request._cached_user = get_user(request)
+        return request._cached_user
 
 class AuthenticationMiddleware(object):
     def process_request(self, request):
3c5782287e

Fixed #2702 -- Fixed LazyUser to store cache as attribute of request, not class. Thanks for the patch, jkocherhans

https://github.com/django/djangoAdrian HolovatySep 12, 2006via ghsa
commit
1 file changed · +3 −6
  • django/contrib/auth/middleware.py+3 −6 modified
    @@ -1,12 +1,9 @@
 class LazyUser(object):
-    def __init__(self):
-        self._user = None
-
     def __get__(self, request, obj_type=None):
-        if self._user is None:
+        if not hasattr(request, '_cached_user'):
             from django.contrib.auth import get_user
-            self._user = get_user(request)
-        return self._user
+            request._cached_user = get_user(request)
+        return request._cached_user
 
 class AuthenticationMiddleware(object):
     def process_request(self, request):

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.