Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. The module serves WebP image derivative responses with the `Cache-Control: public` HTTP header for all file schemes except the private file system, including temporary file systems and access-controlled custom schemes. This behavior can result in users receiving cached versions of files containing information they are not authorized to access, particularly when using a shared cache like Varnish or a CDN that honors the `Cache-Control` header. Exploitation requires the site to serve image derivatives from a custom or temporary file scheme with access control behind such a cache, and the attacker must know the path of a previously requested file remaining in the cache.