{"id":"CVE-2026-114546","kind":"vulnerability","aliases":["CVE-2026-114546"],"related":[],"title":"Drupal Media Alias Display: sensitive data cached in browser","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2.","summary":"The Drupal Media Alias Display module can leave sensitive information in the web browser cache. The description says this is reachable through incorrectly configured access control levels, but the sources do not describe what data is exposed or how.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","media-alias-display","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Media Alias Display module in the Drupal project (`composer show drupal/media_alias_display` or the module's info file).\n- Compare it against the affected ranges: 0.0.0 to 2.1.2 and 3.0.0 to 3.0.2.","fix":"- Media Alias Display versions after 2.1.2 and after 3.0.2 are outside the listed affected ranges; the sources do not name the exact fixed release.","status":"open","published_at":"2026-10-30T04:18:14+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:49+00:00","updated_at":"2026-10-30T04:29:49+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:49Z","model":"claude-haiku-5-5","output":{"fix":"- Media Alias Display versions after 2.1.2 and after 3.0.2 are outside the listed affected ranges; the sources do not name the exact fixed release.","reach":"unknown","title":"Drupal Media Alias Display: sensitive data cached in browser","impact":"medium","summary":"The Drupal Media Alias Display module can leave sensitive information in the web browser cache. The description says this is reachable through incorrectly configured access control levels, but the sources do not describe what data is exposed or how.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","media-alias-display","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive page content readable from a shared browser cache","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114546 and the Drupal security advisory for the exact fixed version, the sensitive data involved and the required access control configuration.","how_to_check":"- Check the installed version of the Media Alias Display module in the Drupal project (`composer show drupal/media_alias_display` or the module's info file).\n- Compare it against the affected ranges: 0.0.0 to 2.1.2 and 3.0.0 to 3.0.2.\n- unknown for any other check; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Media Alias Display module in the affected version ranges. The sources do not say which access control configurations are needed to trigger the cache exposure, so whether a given site is exposed is unknown. Sites not running this module are not affected.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00073,"input_tokens":4132,"output_tokens":634,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114546':12A,15A '-2026':11A,14A '0.0.0':92C '2.1.2':94C '3.0.0':96C '3.0.2':98C 'access':49B,80C 'affect':86C 'alia':3A,19B,28B,74C,88C 'allow':76C 'browser':9A,38B,65C 'cach':7A,39B,66C 'configur':48B,79C 'contain':67C 'control':50B,81C 'cve':10A,13A 'data':6A,59B 'describ':57B 'descript':41B 'display':4A,20B,29B,75C,89C 'drupal':1A,16B,26B,72C 'exploit':77C 'expos':61B 'host':24B 'incorrect':47B,78C 'inform':34B,69C 'issu':85C 'leav':32B 'level':51B,83C 'media':2A,18B,27B,73C,87C 'media-alias-display':17B 'modul':30B 'packag':21B 'reachabl':45B 'say':42B 'secur':82C 'self':23B 'self-host':22B 'sensit':5A,33B,68C 'sourc':54B 'use':62C 'version':90C 'vulner':70C 'web':37B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Media Alias Display module in the affected version ranges. The sources do not say which access control configurations are needed to trigger the cache exposure, so whether a given site is exposed is unknown. Sites not running this module are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114546","severity":null,"published_at":"2026-10-30T04:18:14+00:00","modified_at":"2026-10-30T04:18:14+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}