Live › vulnerability › CVE-2026-114548
The Drupal ImageAPI Optimize WebP module can leave sensitive content in the web browser cache because of incorrectly configured access controls. An attacker who can use the same browser or cache may be able to read cached image data they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal ImageAPI Optimize WebP module at versions up to and including 2.1.2 may be affected. The sources do not say which access control configurations trigger the caching of sensitive content, so exposure beyond that is unknown.
No product ranges from the sources yet.
drush pm:list or composer show drupal/imageapi_optimize_webp).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-114548")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.