{"id":"CVE-2026-87940","kind":"vulnerability","aliases":["CVE-2026-87940"],"related":[],"title":"Drupal Key auth: sensitive data cached in browser, exposed by access control misconfiguration","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.","summary":"The Drupal Key auth module can leave sensitive information in the web browser cache. An attacker who can exploit an incorrectly configured access control setting may be able to read that cached data.","severity":"medium","cvss":5.4,"epss":0.00183,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","php","runtime","self-hosted"],"not_affected_if":["key-auth-not-installed","no-sensitive-pages-exposed"],"how_to_check":"- Check the installed Key auth version with `drush pm:list --filter=key_auth` or in the Drupal admin under Extend; unknown whether other checks apply\n- Review access control settings for the Key auth module and the pages it protects; unknown what exact setting is involved","fix":"- Upgrade the Drupal Key auth module to a version later than `2.2.4`; the first fixed version is unknown from the sources\n- Review access control and cache headers on authenticated pages; unknown what specific change is required","status":"open","published_at":"2026-10-22T02:17:03+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:14:31+00:00","updated_at":"2026-10-25T04:14:31+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:14:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal Key auth module to a version later than `2.2.4`; the first fixed version is unknown from the sources\n- Review access control and cache headers on authenticated pages; unknown what specific change is required","reach":"unknown","title":"Drupal Key auth: sensitive data cached in browser, exposed by access control misconfiguration","impact":"medium","summary":"The Drupal Key auth module can leave sensitive information in the web browser cache. An attacker who can exploit an incorrectly configured access control setting may be able to read that cached data.","category":"runtime","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive data readable from cached browser responses by unauthorized users","analyst_note":"Find the fixed Key auth version and the exact misconfiguration from the NVD entry or the Drupal security advisory for CVE-2026-87940.","how_to_check":"- Check the installed Key auth version with `drush pm:list --filter=key_auth` or in the Drupal admin under Extend; unknown whether other checks apply\n- Review access control settings for the Key auth module and the pages it protects; unknown what exact setting is involved","needs_analyst":true,"not_affected_if":["key-auth-not-installed","no-sensitive-pages-exposed"],"who_is_affected":"Sites running the Drupal Key auth module at version `2.2.4` or earlier, where access control is incorrectly configured so that sensitive responses are stored in shared or browser caches. Sites that do not use the Key auth module, or that do not expose sensitive pages through it, are unlikely to be affected. The sources do not give more detail on the exact configuration needed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":3352,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87940':16A,19A '0.0.0':87C '2.2.4':89C 'abl':53B 'access':11A,48B,76C 'affect':82C 'allow':72C 'attack':41B 'auth':3A,29B,71C,84C 'browser':8A,38B,62C 'cach':6A,39B,57B,63C 'configur':47B,75C 'contain':64C 'control':12A,49B,77C 'cve':14A,17A 'data':5A,58B 'drupal':1A,20B,27B,69C 'exploit':44B,73C 'expos':9A 'host':25B 'incorrect':46B,74C 'inform':34B,66C 'issu':81C 'key':2A,28B,70C,83C 'leav':32B 'level':79C 'may':51B 'misconfigur':13A 'modul':30B 'php':21B 'read':55B 'runtim':22B 'secur':78C 'self':24B 'self-host':23B 'sensit':4A,33B,65C 'set':50B 'use':59C 'version':85C 'vulner':67C 'web':37B,61C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Key auth module at version `2.2.4` or earlier, where access control is incorrectly configured so that sensitive responses are stored in shared or browser caches. Sites that do not use the Key auth module, or that do not expose sensitive pages through it, are unlikely to be affected. The sources do not give more detail on the exact configuration needed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87940","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87940","severity":null,"published_at":"2026-10-22T02:17:03+00:00","modified_at":"2026-10-22T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87940","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87940","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}