Cross-user data disclosure is a confidentiality flaw where data from one user’s request is returned in another user’s response. It usually happens when application code, framework state, caches, or shared formatters reuse values across concurrent requests instead of isolating each session or thread.
In cyber security, this matters because it can leak tokens, personal details, internal messages, or other sensitive content without any obvious crash. Attackers may trigger race conditions, probe shared rendering paths, or send crafted requests that cause one user’s data to be mixed into another user’s output. Defenders look for thread safety, per-request state, strict cache partitioning, and safe handling of localized or formatted content. Any component that stores request data globally or reuses mutable objects can become a disclosure path if isolation is weak.