{"id":"CVE-2026-118571","kind":"vulnerability","aliases":["CVE-2026-118571"],"related":[],"title":"Drupal Media Alias Display: sensitive data cached in browser, exposed to others","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3.","summary":"The Drupal Media Alias Display module can leave sensitive information in the web browser cache because of incorrectly configured access control. An attacker who can use the cached copy may be able to read content that should have been restricted.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","media-alias-display","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the `media_alias_display` module in the Drupal project (for example with `composer show drupal/media_alias_display`).\n- Confirm whether the site serves restricted media through this module and whether caching headers on those responses are set.","fix":"- Versions up to and including `2.1.3` and from `3.0.0` to `3.0.3` are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:08+00:00","updated_at":"2026-10-30T04:29:08+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:08Z","model":"claude-haiku-5-5","output":{"fix":"- Versions up to and including `2.1.3` and from `3.0.0` to `3.0.3` are affected; the sources do not state a fixed version.","reach":"unknown","title":"Drupal Media Alias Display: sensitive data cached in browser, exposed to others","impact":"medium","summary":"The Drupal Media Alias Display module can leave sensitive information in the web browser cache because of incorrectly configured access control. An attacker who can use the cached copy may be able to read content that should have been restricted.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","media-alias-display"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive media content readable from browser cache","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version and the exact access control conditions.","how_to_check":"- Check the installed version of the `media_alias_display` module in the Drupal project (for example with `composer show drupal/media_alias_display`).\n- Confirm whether the site serves restricted media through this module and whether caching headers on those responses are set.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Media Alias Display module in the affected version ranges are exposed. The sources do not describe the exact configuration needed, so teams that do not use this module can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000682,"input_tokens":4132,"output_tokens":537,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118571':15A,18A '-2026':14A,17A '0.0.0':96C '2.1.3':98C '3.0.0':100C '3.0.3':102C 'abl':57B 'access':45B,84C 'affect':90C 'alia':3A,22B,29B,78C,92C 'allow':80C 'attack':48B 'browser':9A,39B,69C 'cach':7A,40B,53B,70C 'configur':44B,83C 'contain':71C 'content':60B 'control':46B,85C 'copi':54B 'cve':13A,16A 'data':6A 'display':4A,23B,30B,79C,93C 'drupal':1A,19B,27B,76C 'exploit':81C 'expos':10A 'incorrect':43B,82C 'inform':35B,73C 'issu':89C 'leav':33B 'level':87C 'may':55B 'media':2A,21B,28B,77C,91C 'media-alias-display':20B 'modul':31B 'other':12A 'packag':24B 'php':25B 'read':59B 'restrict':65B 'secur':86C 'sensit':5A,34B,72C 'use':51B,66C 'version':94C 'vulner':74C 'web':38B,68C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Media Alias Display module in the affected version ranges are exposed. The sources do not describe the exact configuration needed, so teams that do not use this module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118571","severity":null,"published_at":"2026-10-30T04:18:23+00:00","modified_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}