CVE-2007-0405: Django Project Django

Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days.

The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.

Affected products

• Django Project Django: version 0.95 only

Published 2007-01-23. Last modified 2026-06-16.