Access Control Misconfiguration in Drupal AI Leading to Sensitive Data Exposure
CVE-2026-118550

5.9MEDIUM

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118550?

A vulnerability exists in Drupal AI that stems from the improper configuration of access control security levels, leading to the exposure of sensitive information stored in the web browser cache. This issue impacts various versions of the product, making it critical for users to assess their configurations and take necessary precautions to safeguard sensitive data.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.4.11

AI (Artificial Intelligence) 1.5.0 < 1.5.2

References

https://www.drupal.org/sa-contrib-2026-270

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Scott Euser (scott_euser)
Artem Dmitriiev (a.dmitriiev)
Scott Euser (scott_euser)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.