CVE-2026-114546

Name of the Vulnerable Software and Affected Versions Media Alias Display versions 0.0.0 through 2.1.2 Media Alias Display versions 3.0.0 through 3.0.2

Description Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. The module enables direct viewing of files via URL aliases, but some files may be served with the Cache-Control: public HTTP header when they should be uncacheable. This allows users to access cached versions of files containing information they are not authorized to see. Exploitation requires an attacker to request a file previously accessed by a more-privileged user while that file remains in the cache.

Recommendations Update Media Alias Display versions 0.0.0 through 2.1.2 to a version newer than 2.1.2. Update Media Alias Display versions 3.0.0 through 3.0.2 to a version newer than 3.0.2. Configure Drupal to handle non-public files using a custom or contributed module that provides an additional file scheme.