Authorization Bypass in Scriban via Stale Template Cache

Scriban, a popular templating engine for .NET, contains a vulnerability (CVE-2026-74791) in versions prior to 7.0.0. The issue stems from the failure to properly clear the CachedTemplates dictionary when the TemplateContext.Reset() method is invoked. This flaw allows cached templates to persist across different rendering contexts. In applications where ITemplateLoader implementations are request-dependent, this behavior can be leveraged by an attacker to access template content that was intended for a different, potentially more privileged user or request context. Because the template is retrieved from the stale cache, the TemplateLoader.Load() method is not re-triggered, bypassing intended authorization checks that would typically occur during the loading phase. This vulnerability poses a significant risk of unauthorized information disclosure in multi-tenant or request-heavy applications.

Impact

The vulnerability allows for unauthorized access to sensitive information by serving cached template content across security boundaries. If an application relies on per-request authorization during the loading of templates, an attacker may be able to view content rendered for other users. This vulnerability is rated as high severity due to the potential for unauthorized data access without requiring user interaction or authentication.

Recommendation

1. Upgrade all instances of the Scriban library to version 7.0.0 or higher to ensure the CachedTemplates dictionary is correctly reset.
2. Audit applications using Scriban that implement custom ITemplateLoader logic, specifically checking if authorization checks are performed only during the Load() method, as this will be bypassed for cached templates.
3. Monitor application logs for anomalous template rendering activity or unexpected data access patterns in environments leveraging reused TemplateContext objects.