---
id: "CVE-2026-118550"
kind: "vulnerability"
aliases: ["CVE-2026-118550"]
title: "Drupal AI module: sensitive data cached in browser, exposing it to others"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ai-tooling", "drupal", "package", "php"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:20+00:00"
first_seen_at: "2026-10-30T04:28:38+00:00"
updated_at: "2026-10-30T04:29:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118550", "first_seen_at": "2026-10-30T04:28:38+00:00"}]
---

# Drupal AI module: sensitive data cached in browser, exposing it to others

The Drupal AI (Artificial Intelligence) module caches sensitive information in the web browser because of incorrectly configured access control. An attacker who can use the same browser or cache can read data that should have been restricted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `drupal/ai` version in composer.lock or with `composer show drupal/ai`
- Compare the version against the affected range: `0.0.0` through `1.4.11`, and `1.5.0` through `1.5.2`

## Fix

- Move the `drupal/ai` module to a version above `1.5.2`; the sources do not name the exact fixed release

## Timeline

- 2026-10-30T04:28:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118550

## From the sources

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_