Live › vulnerability › CVE-2026-118550
The Drupal AI (Artificial Intelligence) module caches sensitive information in the web browser because of incorrectly configured access control. An attacker who can use the same browser or cache can read data that should have been restricted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal AI module in the affected version ranges. The sources do not describe further configuration conditions, so treat any site with the module installed as potentially exposed.
No product ranges from the sources yet.
drupal/ai version in composer.lock or with composer show drupal/ai0.0.0 through 1.4.11, and 1.5.0 through 1.5.2drupal/ai module to a version above ; the sources do not name the exact fixed release1.5.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-118550")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.