Authorization Bypass in Scriban Template Engine by Scriban

CVE-2026-74791

What is CVE-2026-74791?

The Scriban Template Engine prior to version 7.0.0 has a flaw that fails to clear the CachedTemplates dictionary when the TemplateContext.Reset() method is invoked. This oversight allows previously rendered templates to persist across reused contexts, creating an opportunity for attackers to exploit implementations of ITemplateLoader that are request-dependent. As a result, unauthorized access to sensitive template content from earlier renders may occur without necessitating a new call to TemplateLoader.Load(), thereby increasing the risk of information disclosure.

References