django
diff --git a/‎django/middleware/cache.py‎
Lines changed: 11 additions & 2 deletions b/‎django/middleware/cache.py‎
Lines changed: 11 additions & 2 deletions
diff --git a/‎docs/releases/5.2.15.txt‎
Lines changed: 16 additions & 0 deletions b/‎docs/releases/5.2.15.txt‎
Lines changed: 16 additions & 0 deletions
diff --git a/‎tests/cache/tests.py‎
Lines changed: 19 additions & 10 deletions b/‎tests/cache/tests.py‎
Lines changed: 19 additions & 10 deletions
@@ -100,8 +100,17 @@ def process_response(self, request, response):
         ):
             return response
 
-        # Don't cache a response with 'Cache-Control: private'
-        if "private" in response.get("Cache-Control", ()):
+        # Don't cache responses when the Cache-Control header is set to
+        # private, no-cache, or no-store.
+        cache_control = response.get("Cache-Control", "").lower()
+        if cache_control and any(
+            directive in cache_control
+            for directive in (
+                "private",
+                "no-cache",
+                "no-store",
+            )
+        ):
             return response
 
         # Don't cache responses when the Vary header contains '*'.
 
@@ -35,3 +35,19 @@ Connections configured with :setting:`EMAIL_USE_SSL` are not affected.
 
 This issue has severity "low" according to the :ref:`Django security policy
 <severity-levels>`.
+
+CVE-2026-8404: Potential exposure of private data via case-sensitive ``Cache-Control`` directives
+=================================================================================================
+
+:class:`~django.middleware.cache.UpdateCacheMiddleware` and
+:func:`~django.views.decorators.cache.cache_page` incorrectly cached responses
+marked with private ``Cache-Control`` directives when using mixed or uppercase
+values (e.g. ``Private``).
+
+The :func:`~django.views.decorators.cache.cache_control` decorator and
+:func:`~django.utils.cache.patch_cache_control` function were not affected,
+since they normalize directives to lowercase. This issue only affects responses
+where ``Cache-Control`` is set manually.
+
+This issue has severity "low" according to the :ref:`Django security policy
+<severity-levels>`.
@@ -2734,16 +2734,25 @@ def test_cache_page_timeout(self):
                 )
             cache.clear()
 
-    def test_cached_control_private_not_cached(self):
-        """Responses with 'Cache-Control: private' are not cached."""
-        view_with_private_cache = cache_page(3)(
-            cache_control(private=True)(hello_world_view)
-        )
-        request = self.factory.get("/view/")
-        response = view_with_private_cache(request, "1")
-        self.assertEqual(response.content, b"Hello World 1")
-        response = view_with_private_cache(request, "2")
-        self.assertEqual(response.content, b"Hello World 2")
+    def test_cache_control_not_cached(self):
+        """
+        Responses with 'Cache-Control: private/no-cache/no-store' are
+        not cached.
+        """
+        for cc in ("private", "no-cache", "no-store", "PRIVATE", "NO-store"):
+            with self.subTest(cache_control=cc):
+                # Cannot use @cache_control() as it lowercases directives.
+                @cache_page(3)
+                def view(request, value):
+                    return HttpResponse(
+                        f"Hello World {value}", headers={"Cache-Control": cc}
+                    )
+
+                request = self.factory.get("/view/")
+                response = view(request, "1")
+                self.assertEqual(response.content, b"Hello World 1")
+                response = view(request, "2")
+                self.assertEqual(response.content, b"Hello World 2")
 
     def test_vary_asterisk_not_cached(self):
         views_with_cache = (