Live › vulnerability › CVE-2026-114546
The Drupal Media Alias Display module can leave sensitive information in the web browser cache. The description says this is reachable through incorrectly configured access control levels, but the sources do not describe what data is exposed or how.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Media Alias Display module in the affected version ranges. The sources do not say which access control configurations are needed to trigger the cache exposure, so whether a given site is exposed is unknown. Sites not running this module are not affected.
No product ranges from the sources yet.
composer show drupal/media_alias_display or the module's info file).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-114546")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.