{"id":"CVE-2026-114548","kind":"vulnerability","aliases":["CVE-2026-114548"],"related":[],"title":"Drupal ImageAPI Optimize WebP: browser cache can expose sensitive images","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.","summary":"The Drupal ImageAPI Optimize WebP module can leave sensitive content in the web browser cache because of incorrectly configured access controls. An attacker who can use the same browser or cache may be able to read cached image data they should not see.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the ImageAPI Optimize WebP module in the Drupal project (for example with `drush pm:list` or `composer show drupal/imageapi_optimize_webp`).\n- Confirm whether the module is enabled on the site.","fix":"- ImageAPI Optimize WebP: versions from 0.0.0 to 2.1.2 are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:18:15+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:45+00:00","updated_at":"2026-10-30T04:29:45+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:45Z","model":"claude-haiku-5-5","output":{"fix":"- ImageAPI Optimize WebP: versions from 0.0.0 to 2.1.2 are affected; the sources do not name a fixed version.","reach":"unknown","title":"Drupal ImageAPI Optimize WebP: browser cache can expose sensitive images","impact":"medium","summary":"The Drupal ImageAPI Optimize WebP module can leave sensitive content in the web browser cache because of incorrectly configured access controls. An attacker who can use the same browser or cache may be able to read cached image data they should not see.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive image content readable from browser cache","analyst_note":"Find the Drupal advisory for ImageAPI Optimize WebP to confirm the fixed version, the exact misconfiguration and the affected cache headers (https://nvd.nist.gov/vuln/detail/CVE-2026-114548).","how_to_check":"- Check the installed version of the ImageAPI Optimize WebP module in the Drupal project (for example with `drush pm:list` or `composer show drupal/imageapi_optimize_webp`).\n- Confirm whether the module is enabled on the site.\n- unknown for any further configuration check, as the sources do not say which cache headers or settings are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal ImageAPI Optimize WebP module at versions up to and including 2.1.2 may be affected. The sources do not say which access control configurations trigger the caching of sensitive content, so exposure beyond that is unknown.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":4134,"output_tokens":651,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114548':13A,16A '-2026':12A,15A '0.0.0':96C '2.1.2':98C 'abl':56B 'access':42B,84C 'affect':90C 'allow':80C 'attack':45B 'browser':5A,36B,51B,69C 'cach':6A,37B,53B,59B,70C 'configur':41B,83C 'contain':71C 'content':32B 'control':43B,85C 'cve':11A,14A 'data':61B 'drupal':1A,17B,24B,76C 'exploit':81C 'expos':8A 'host':22B 'imag':10A,60B 'imageapi':2A,25B,77C,91C 'incorrect':40B,82C 'inform':73C 'issu':89C 'leav':30B 'level':87C 'may':54B 'modul':28B 'optim':3A,26B,78C,92C 'packag':18B 'php':19B 'read':58B 'secur':86C 'see':65B 'self':21B 'self-host':20B 'sensit':9A,31B,72C 'use':48B,66C 'version':94C 'vulner':74C 'web':35B,68C 'webp':4A,27B,79C,93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal ImageAPI Optimize WebP module at versions up to and including 2.1.2 may be affected. The sources do not say which access control configurations trigger the caching of sensitive content, so exposure beyond that is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114548","severity":null,"published_at":"2026-10-30T04:18:15+00:00","modified_at":"2026-10-30T04:18:15+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}