Live › vulnerability › CVE-2026-118571
The Drupal Media Alias Display module can leave sensitive information in the web browser cache because of incorrectly configured access control. An attacker who can use the cached copy may be able to read content that should have been restricted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Media Alias Display module in the affected version ranges are exposed. The sources do not describe the exact configuration needed, so teams that do not use this module can skip it.
No product ranges from the sources yet.
media_alias_display module in the Drupal project (for example with composer show drupal/media_alias_display).2.1.3 and from 3.0.0 to 3.0.3 are affected; the sources do not state a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-118571")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.