Use of Cache Containing Sensitive Information

Sensitive, user-specific data ends up in a cache that's shared across users or persists longer than it should - an HTTP intermediary or CDN caching a response containing one user's personal data and serving that same cached response to a different user who requests the same URL, or a browser caching a sensitive page that remains recoverable after logout on a shared computer.

This overlaps closely with the cache-key/unkeyed-input problem that web cache poisoning tests for, but from the angle of sensitive-data leakage rather than attacker-controlled content injection - confirming genuine cross-user leakage requires comparing responses across two distinct user sessions requesting the same cached URL, a two-account test.

Testing for the underlying cache-keying misconfiguration that enables both poisoning and this leakage variant covers the setup side of the problem. Confirming actual sensitive-data cross-user leakage specifically requires an authenticated two-account comparison test.

Tip: These are usually found by someone deliberately reasoning about what data a given cache, log, include file, or response should and shouldn't contain, rather than through a technical exploitation technique — a manual data-flow review specifically for sensitive content is the most reliable discovery method.

Real-World Impact

Privacy and sensitive-data-handling flaws cover exposure that happens even when every conventional technical control (authentication, authorization, encryption) is working as designed — data ends up somewhere it shouldn't through a policy gap, an over-broad cache, an included file left in a public build, or a mismatch between what one part of the system assumes about data sensitivity and what another part actually does with it.

The severity depends entirely on what data is exposed and to whom, but the regulatory dimension is often the larger practical concern: unauthorized exposure of personal data can trigger GDPR, CCPA, or sector-specific (HIPAA, and similar) reporting and penalty obligations regardless of whether the exposure was ever actually exploited by a third party, since the obligation is typically triggered by the exposure itself.

These flaws are also disproportionately likely to be found by researchers rather than automated tooling, since they usually require understanding what data a given context should and shouldn't have access to — a judgment call a generic scanner has no basis for making.

Prevention and Secure Design

Preventing Use of Cache Containing Sensitive Information takes a defense-in-depth approach — no single control below is sufficient alone, but together they close off both the primary path and the most common bypasses.

Classify data sensitivity explicitly, and enforce handling rules by classification. Treat "what's sensitive" as an explicit, documented decision propagated through caching, logging, and inclusion policies — not an assumption each component makes independently.

Apply data minimization. Don't retain, cache, log, or transmit sensitive data that isn't actually needed for the current operation — the cheapest way to reduce exposure risk is reducing what could be exposed at all.

Audit caches, includes, and build artifacts for sensitive content specifically. Files included at build time, cached responses, and log output are common places sensitive data ends up without anyone deciding it should be there.

Align policy across every component that touches the data. A privacy commitment made at the product or legal level has to be reflected consistently in every technical component that handles that data — a gap between the two is exactly where this class lives.

Have privacy/data-handling reviewed as its own discipline. This overlaps with but isn't identical to general security review — someone specifically thinking about data lifecycle and exposure paths catches issues a pure access-control review misses.