{"id":"CVE-2026-89186","summary":"mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches","details":"Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid.\n\nMPP.Plug.verify_credential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application runs, and registers no register_before_send/2 callback. Plug.Conn.put_resp_header/3 replaces an existing header, so a mounting application that sets its own cache-control on the paid resource (for example public, max-age=3600) silently overrides the private the library relies on, and a CDN or reverse proxy can then store the paid 200 together with its Payment-Receipt and serve both to unpaid clients. The library-level guarantee is therefore defeatable by the application it protects. For the same reason a downstream non-2xx response still carried Payment-Receipt, issuing a receipt for a response that delivered no resource.\n\nThis issue affects mpp: from 0.1.0 before 0.16.2.","aliases":["EEF-CVE-2026-89186","GHSA-82qh-vrvm-gqvc"],"modified":"2026-09-18T03:48:32.983232645Z","published":"2026-09-16T08:24:15.058Z","database_specific":{"cna_assigner":"EEF","cwe_ids":["CWE-524"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89186.json","unresolved_ranges":[{"extracted_events":[{"introduced":"2d4d1d94aae7790ae0623063961adbeef171fa71"},{"fixed":"2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-89186.html"},{"type":"WEB","url":"https://github.com"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-89186"},{"type":"WEB","url":"https://repo.hex.pm"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89186.json"},{"type":"ADVISORY","url":"https://github.com/ZenHive/mpp/security/advisories/GHSA-82qh-vrvm-gqvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89186"},{"type":"FIX","url":"https://github.com/ZenHive/mpp/commit/2d4d1d94aae7790ae0623063961adbeef171fa71"},{"type":"FIX","url":"https://github.com/ZenHive/mpp/commit/2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b"},{"type":"PACKAGE","url":"https://github.com/ZenHive/mpp"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zenhive/mpp","events":[{"introduced":"8e43e7285931741e2b9aecf90c8439bb84ca8e4c"},{"fixed":"3b7e43abf60fa30c40985e4043965ec67791b4dc"},{"fixed":"2d4d1d94aae7790ae0623063961adbeef171fa71"},{"fixed":"2fd91a5ecbd0b0ad2a4ac202b79659e8126dbc0b"}],"database_specific":{"extracted_events":[{"introduced":"0.1.0"},{"fixed":"0.16.2"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v0.16.1","v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.0","v0.6.4","v0.6.3","v0.6.1","v0.6.0","v0.5.1","v0.4.0","v0.3.0","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89186.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}]}