{"id":"CVE-2026-118550","kind":"vulnerability","aliases":["CVE-2026-118550"],"related":[],"title":"Drupal AI module: sensitive data cached in browser, exposing it to others","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","summary":"The Drupal AI (Artificial Intelligence) module caches sensitive information in the web browser because of incorrectly configured access control. An attacker who can use the same browser or cache can read data that should have been restricted.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed `drupal/ai` version in composer.lock or with `composer show drupal/ai`\n- Compare the version against the affected range: `0.0.0` through `1.4.11`, and `1.5.0` through `1.5.2`","fix":"- Move the `drupal/ai` module to a version above `1.5.2`; the sources do not name the exact fixed release","status":"open","published_at":"2026-10-30T04:18:20+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:29+00:00","updated_at":"2026-10-30T04:29:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:29Z","model":"claude-haiku-5-5","output":{"fix":"- Move the `drupal/ai` module to a version above `1.5.2`; the sources do not name the exact fixed release","reach":"unknown","title":"Drupal AI module: sensitive data cached in browser, exposing it to others","impact":"medium","summary":"The Drupal AI (Artificial Intelligence) module caches sensitive information in the web browser because of incorrectly configured access control. An attacker who can use the same browser or cache can read data that should have been restricted.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","ai-tooling"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive data readable from browser cache by other users","analyst_note":"Confirm the fixed version and whether the flaw needs a specific access control configuration; check the NVD entry and the Drupal security advisory for drupal/ai.","how_to_check":"- Check the installed `drupal/ai` version in composer.lock or with `composer show drupal/ai`\n- Compare the version against the affected range: `0.0.0` through `1.4.11`, and `1.5.0` through `1.5.2`","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal AI module in the affected version ranges. The sources do not describe further configuration conditions, so treat any site with the module installed as potentially exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000685,"input_tokens":4148,"output_tokens":541,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118550':15A,18A '-2026':14A,17A '0.0.0':92C '1.4.11':94C '1.5.0':96C '1.5.2':98C 'access':42B,80C 'affect':86C 'ai':2A,20B,27B,73C,87C 'ai-tool':19B 'allow':76C 'artifici':28B,74C,88C 'attack':45B 'browser':8A,37B,51B,65C 'cach':6A,31B,53B,66C 'configur':41B,79C 'contain':67C 'control':43B,81C 'cve':13A,16A 'data':5A,56B 'drupal':1A,22B,26B,72C 'exploit':77C 'expos':9A 'incorrect':40B,78C 'inform':33B,69C 'intellig':29B,75C,89C 'issu':85C 'level':83C 'modul':3A,30B 'other':12A 'packag':23B 'php':24B 'read':55B 'restrict':61B 'secur':82C 'sensit':4A,32B,68C 'tool':21B 'use':48B,62C 'version':90C 'vulner':70C 'web':36B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal AI module in the affected version ranges. The sources do not describe further configuration conditions, so treat any site with the module installed as potentially exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118550","severity":null,"published_at":"2026-10-30T04:18:20+00:00","modified_at":"2026-10-30T04:18:20+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}