---
id: "CVE-2026-118571"
kind: "vulnerability"
aliases: ["CVE-2026-118571"]
title: "Drupal Media Alias Display: sensitive data cached in browser, exposed to others"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "media-alias-display", "package", "php"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:23+00:00"
first_seen_at: "2026-10-30T04:28:39+00:00"
updated_at: "2026-10-30T04:29:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118571", "first_seen_at": "2026-10-30T04:28:39+00:00"}]
---

# Drupal Media Alias Display: sensitive data cached in browser, exposed to others

The Drupal Media Alias Display module can leave sensitive information in the web browser cache because of incorrectly configured access control. An attacker who can use the cached copy may be able to read content that should have been restricted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the `media_alias_display` module in the Drupal project (for example with `composer show drupal/media_alias_display`).
- Confirm whether the site serves restricted media through this module and whether caching headers on those responses are set.

## Fix

- Versions up to and including `2.1.3` and from `3.0.0` to `3.0.3` are affected; the sources do not state a fixed version.

## Timeline

- 2026-10-30T04:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118571

## From the sources

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_