CVE-2026-114546
Received Received - Intake

Drupal Media Alias Display Cache Information Disclosure

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Drupal.org

Description
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-114546
EUVD
EUVD-2026-113527

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Drupal Media Alias Display 0.0.0
Drupal Media Alias Display 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-525 The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves sensitive information being stored in a web browser's cache due to incorrect access control settings in Drupal Media Alias Display. The flaw allows unauthorized parties to potentially access cached data if the browser cache is not properly secured.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive data stored in browser caches, such as user credentials or personal information. Attackers might retrieve cached content if the browser cache is not properly protected.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive user data through improperly secured browser caches. Organizations may face compliance penalties if such breaches occur due to inadequate access controls.

Mitigation Strategies

Update Drupal Media Alias Display to a version beyond 3.0.2 or 2.1.2 to address the vulnerability. Check for misconfigured access control settings in the module and ensure sensitive information is not cached in the browser.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart