{"id":"CVE-2026-118568","kind":"vulnerability","aliases":["CVE-2026-118568"],"related":[],"title":"Drupal Content Sync: insecure storage exposes embedded sensitive data","description":"Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.","summary":"Drupal Content Sync stores sensitive information in an insecure way, so data embedded in exported content can be retrieved. The sources do not say what the data is or what access an attacker needs to read it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["content-sync","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Content Sync version with `drush pm:list --filter=content_sync` on a Drupal site.\n- Look for Content Sync in the Drupal `composer.lock` file and note the `drupal/content_sync` version.","fix":"- Content Sync versions from 0.0.0 to `3.2.2` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:18:22+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:12+00:00","updated_at":"2026-10-30T04:29:12+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:12Z","model":"claude-haiku-5-5","output":{"fix":"- Content Sync versions from 0.0.0 to `3.2.2` are affected; the sources do not name a fixed version.","reach":"unknown","title":"Drupal Content Sync: insecure storage exposes embedded sensitive data","impact":"medium","summary":"Drupal Content Sync stores sensitive information in an insecure way, so data embedded in exported content can be retrieved. The sources do not say what the data is or what access an attacker needs to read it.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","content-sync","php"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive data embedded in synced content is readable by attackers","analyst_note":"Find the Drupal security advisory for Content Sync to confirm the fixed version, the exposed data and the required access; the NVD entry alone does not say.","how_to_check":"- Check the installed Content Sync version with `drush pm:list --filter=content_sync` on a Drupal site.\n- Look for Content Sync in the Drupal `composer.lock` file and note the `drupal/content_sync` version.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Content Sync module (content-sync.io) at version 3.2.2 or earlier are in scope. The sources do not say which configuration or data path exposes the embedded sensitive data, so teams should confirm whether their exported content holds secrets before ruling themselves out.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4120,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118568':12A,15A '-2026':11A,14A '0.0.0':82C '3.2.2':84C 'access':52B 'affect':76C 'allow':69C 'attack':54B 'content':2A,17B,23B,37B,66C,77C 'content-sync':16B 'content-sync.io':68C,79C 'cve':10A,13A 'data':9A,33B,48B,73C 'drupal':1A,19B,22B,65C 'embed':7A,34B,71C 'export':36B 'expos':6A 'inform':27B,62C 'insecur':4A,30B,58C 'issu':75C 'need':55B 'packag':20B 'php':21B 'read':57B 'retriev':40B,70C 'say':45B 'sensit':8A,26B,61C,72C 'sourc':42B 'storag':5A,59C 'store':25B 'sync':3A,18B,24B,67C,78C 'version':80C 'vulner':63C 'way':31B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Content Sync module (content-sync.io) at version 3.2.2 or earlier are in scope. The sources do not say which configuration or data path exposes the embedded sensitive data, so teams should confirm whether their exported content holds secrets before ruling themselves out.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118568","severity":null,"published_at":"2026-10-30T04:18:22+00:00","modified_at":"2026-10-30T04:18:22+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}