The webservice can return personal data, such as user ratings, on unauthenticated requests, if the same request was done before with authentication enabled.

This was detected using Picard, but was reproducible outside. After requesting the below request with oauth authentication enabled (Authorization header with valid token for my account), Picard was afterwards able to repeat the same request without Auhtorization header present. Below are the URL, the request headers and the response headers.

URL: https://musicbrainz.org/ws/2/release/86baa9d0-b610-4721-80ee-bc70f5c0680a?inc=aliases+annotation+artist-credits+artist-rels+artists+collections+discids+isrcs+label-rels+labels+media+recording-rels+recordings+release-group-level-rels+release-groups+release-rels+series-rels+url-rels+user-ratings+work-rels

Request headers:
  user-agent: MusicBrainz-Picard/3.0.0.beta9 (Linux-6.17.0-124040-tuxedo-x86_64-with-glibc2.39;CPython-3.14.6)
  accept: application/json

Reply headers:
  date: Sun, 09 Aug 2026 08:07:08 GMT
  content-type: application/json; charset=utf-8
  vary: Accept-Encoding
  x-ratelimit-limit: 1200
  x-ratelimit-remaining: 951
  x-ratelimit-reset: 1786262829
  server: Plack::Handler::Starlet
  etag: W/"f89ae0f22ac73b52a0cfc75cc3c32ce4"
  access-control-allow-origin: *
  x-runtime: 0.321503
  x-cache-status: STALE
  content-encoding: gzip

The response contains my user-ratings for the release, such as for track 11:

"user-rating": {
    "value": 4
},

Furthermore, I was able to use the fetch this exact same URL using bruno (https://www.usebruno.com/) with the same headers, and it includes my rating as well. The `user-agent` header can even be omitted, it does not seem relevant for caching.

Any change to the URL causes the expected 401 response. But unchanged URL gives the stale cache.

I so far failed with curl to do the same (with curl I get the expected 401). It probably includes some other data.