---
id: "CVE-2026-114546"
kind: "vulnerability"
aliases: ["CVE-2026-114546"]
title: "Drupal Media Alias Display: sensitive data cached in browser"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "media-alias-display", "package", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:14+00:00"
first_seen_at: "2026-10-30T04:28:37+00:00"
updated_at: "2026-10-30T04:29:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114546", "first_seen_at": "2026-10-30T04:28:37+00:00"}]
---

# Drupal Media Alias Display: sensitive data cached in browser

The Drupal Media Alias Display module can leave sensitive information in the web browser cache. The description says this is reachable through incorrectly configured access control levels, but the sources do not describe what data is exposed or how.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Media Alias Display module in the Drupal project (`composer show drupal/media_alias_display` or the module's info file).
- Compare it against the affected ranges: 0.0.0 to 2.1.2 and 3.0.0 to 3.0.2.

## Fix

- Media Alias Display versions after 2.1.2 and after 3.0.2 are outside the listed affected ranges; the sources do not name the exact fixed release.

## Timeline

- 2026-10-30T04:28:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114546

## From the sources

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_